nCino Inc
For the period ended Jan 31, 2025. Filed Apr 1, 2025.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2025 · Filed Apr 1, 2025
NCNO$22.94+1.2%Stored close · as of Nov 9, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2024-01-31; filed 2024-03-26.
0001902733-24-000053
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2025-01-31; filed 2025-04-01.
0001902733-25-000026
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 207 previous paragraphs and 212 current paragraphs.
142 unchanged; 60 reworded; 6 added; 5 removed; 0 previous and 4 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (6)
Current report
We have recently adopted a new pricing model, which sets the pricing for our solutions primarily on the asset size of the FI customer, and began implementing it in fiscal 2025. While we believe this new model responds to how we have observed customers using our solutions and evolving market conditions, there is no assurance that our existing customers will react favorably to it, or that potential new customers will adopt it. It is also possible that the new pricing model will not generate the revenues we expect from it for other reasons. Any of these factors could lead to an adverse effect on our results of operations or financial conditions and have a negative impact on the price of our common stock.
Current report
GLBA and FCRA impose privacy and information security requirements on FIs, including obligations to protect and safeguard consumers’ nonpublic personal information and creditworthiness information, respectively, and limitations on the use and disclosure of such information. The GLBA requires appropriate administrative, technical and physical safeguards to ensure the security, confidentiality, integrity, availability and the proper disposal of nonpublic personal information, and the FCRA imposes similar information security requirements regarding the protection of creditworthiness information.
Current report
The Federal Trade Commission (“FTC”) and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information and in particular health information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act.
Current report
Additionally, as we continue to increase building AI/ML into many of our solutions, we face more competition as AI/ML technologies are increasingly integrated into the markets in which we compete. New AI/ML offerings may disrupt workforce needs and negatively impact demand for our solutions, or our competitors may be able to incorporate AI/ML into their offerings more efficiently or successfully than we are able to incorporate it into our solutions, and thereby achieve greater and faster adoption. Even if our AI/ML solutions are more effective than the products and services that our competitors offer, potential customers might select competitive products and services in lieu of purchasing our services.
Current report
More generally, our use of AI/ML technologies may present additional risks and challenges that could affect their adoption and therefore our business. For example, the development of our AI/ML solutions may present ethical or social issues. If we enable or offer solutions that draw controversy due to their perceived or actual impact privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially in the context of an environment with heightened geopolitical volatility. Inadequate or ineffective AI/ML development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI/ML solutions or result in unintended performance of the services. This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI/ML solutions produce, subjecting us to competitive harm, legal liability and brand or reputational harm. The rapid evolution of AI/ML will require the application of resources to develop, test and maintain our products and services to help ensure that AI/ML is implemented ethically in order to minimize unintended, harmful impact. Uncertainty around new and emerging AI/ML applications such as generative AI content creation and AI/ML agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our results of operations and financial condition. Moreover, the development of generative AI/ML solutions brings additional risks and responsibility. Known risks of generative AI/ML currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance. For example, AI/ML technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability. Developing, testing and deploying AI/ML systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed.
Current report
Our board appointed Sean Desmond as our new Chief Executive Officer, effective February 1, 2025, and Pierre Naudé resigned as Chief Executive Officer, a position he had held since nCino's inception. Mr. Naudé continues to serve as Executive Chairman. As with any other company transitioning from a long-serving Chief Executive Officer, it will be important to maintain the innovation, creativity, teamwork and other elements essential to the continued growth of our business under new leadership. Any failure to do so may have an adverse impact on our results of operations and financial condition.
Removed paragraphs (5)
Previous report
•Because one of our stockholders holds a substantial amount of our total outstanding common stock, the influence of our public stockholders over significant corporate actions is limited and sales by this stockholder could adversely affect the value of our common stock.
Previous report
•We are presently subject to a purported stockholder derivative lawsuit alleging violation of fiduciary duties with the series of mergers in which we became the parent of nCino OpCo and SimpleNexus. The court dismissed these claims and that decision is currently under appeal. This matter or future litigation against us could adversely affect our operations and prospects, damage our reputation, and be costly and time consuming to defend.
Previous report
The E.U. has also proposed the draft ePrivacy Regulation which, once finalized and in effect, will replace both the ePrivacy Directive and all the national laws implementing this Directive. The ePrivacy Regulation, as proposed in its current form, would impose strict opt-in marketing rules, change rules about the use of cookies, web beacons, and related technologies, and significantly increase penalties for violations. It would also retain the additional consent standards as required under the EU GDPR. Such regulations may have a negative effect on businesses, including ours, that collect, process, and use personal data in the EU and UK, including online usage information for consumer acquisition and marketing and may increase the potential civil liability and cost of operating a business that collects, processes, or uses such information and undertakes online marketing.
Previous report
Because one of our stockholders holds a substantial amount of our total outstanding common stock, the influence of our public stockholders over significant corporate actions is limited and sales by this stockholder could adversely affect the value of our common stock.
Previous report
Based on the total number of shares of our common stock outstanding as of January 31, 2024, entities affiliated with Insight Partners (“Insight Partners”) holds approximately 34% of our total outstanding common stock. As a result, Insight Partners has the ability to influence the outcome of corporate actions requiring stockholder approval, including the election of directors, the approval of mergers, or other changes of corporate control, any of which may be in opposition to the best interests of our other stockholders and may adversely impact our results of operations and the value of our common stock. Sales of our common stock by Insight Partners could have an immediate and substantial adverse effect on the value of our common stock.
Reworded paragraphs (60)
Previous wording
•We derive all of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.
Current wording
•We derive most of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.
Previous wording
•We have a limited operating history at the current scale of our business, which makes it difficult to predict our future operating results, and we may not achieve our expected operating results in the future.
Current wording
•Our future operating results are difficult to predict, in part because we do not have an extensive operating history at the current scale of our business, and we may not achieve our expected operating results in the future.
Previous wording
•If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate, our sales would suffer and our results of operations would be adversely affected.
Current wording
•As the market for cloud-based banking technology continues to develop, it may do so more slowly than we expect or changes in a way that we fail to anticipate, in which case our sales would suffer and our results of operations would be adversely affected.
Previous wording
We may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results.
Current wording
•We have recently changed our pricing model, and that and other factors may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results.
Previous wording
•A breach of our security measures or those we rely on could result in unauthorized access to customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.
Current wording
•A breach of our security or privacy measures or those we rely on could result in unauthorized access to, or disclosure of, customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.
Previous wording
•Fundamental elements of the nCino Bank Operating System are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.
Current wording
•Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.
Previous wording
The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies or other competitive dynamics could adversely affect our business and results of operations.
Current wording
•The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies, including the increasing adoption of artificial intelligence and machine learning ("AI/ML") offerings by our competitors, or other competitive dynamics could adversely affect our business and results of operations.
Previous wording
•Our increased focus on the development and use of artificial intelligence and machine learning technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.
Current wording
•Our increased focus on the development and use of AI/ML technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.
Previous wording
We may acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments, or partnerships.
Current wording
•We have and may continue to acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments or partnerships.
Previous wording
•Our customers are highly regulated and subject to a number of challenges and risks. Our failure to comply with laws and regulations applicable to us as a technology provider to FIs could adversely affect our business and results of operations, increase costs and impose constraints on the way we conduct our business.
Current wording
•Our customers are highly regulated. Our failure to comply with laws and regulations applicable to us as a technology provider to FIs could adversely affect our business and results of operations, increase costs and impose constraints on the way we conduct our business.
Previous wording
We derive all of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.
Current wording
We derive most of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.
Previous wording
All of our revenues are derived from FIs whose industry has experienced significant pressure in recent years due to economic uncertainty, fluctuating interest rates, liquidity concerns and increased regulation. In the past, FIs have experienced consolidation, distress and failure, including in March 2023 when the FDIC took control of Silicon Valley Bank and Signature Bank due to liquidity concerns and a number of other FIs experienced turbulence and a precipitous decline in market value. It is possible these conditions may persist, deteriorate or reoccur. If as a result of these or other factors any of our customers merge with or are acquired by other entities, such as FIs that have internally developed banking technology solutions or that are not our customers or use our solutions less, we may lose business. Additionally, changes in management of our customers could result in delays or cancellations of the implementation of our solutions. It is also possible that the larger FIs that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions. Our business may also be materially and adversely affected by weak economic conditions in the financial services industry. Any downturn or prolonged disruption in the financial services industry may cause our customers to reduce their spending on technology or cloud-based banking applications or to seek to terminate or renegotiate their contracts with us. Moreover, economic fluctuations caused by factors such as the U.S. Federal Reserve changing interest rates may cause potential new customers and existing customers to forego or delay purchasing our solutions or reduce the amount of spend with us, which would materially and adversely affect our business.
Current wording
Most of our revenues are derived from FIs whose industry has experienced significant pressure in recent years due to economic uncertainty, fluctuating interest rates, liquidity concerns and increased regulation. In the past, FIs have experienced consolidation, distress and failure, including notably recently in March 2023 when the FDIC took control of Silicon Valley Bank and Signature Bank due to liquidity concerns and a number of other FIs experienced turbulence and a precipitous decline in market value. It is possible these conditions may persist, deteriorate or reoccur. If, as a result of these or other factors, any of our customers merge with or are acquired by other entities, such as FIs that have internally developed banking technology solutions or that are not our customers or use our solutions less, we may lose business. Additionally, changes in management of our customers could result in delays or cancellations of the implementation of our solutions. It is also possible that the larger FIs that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions. Our business may also be materially and adversely affected by weak economic conditions in the financial services industry. Any downturn or prolonged disruption in the financial services industry may cause our customers to reduce their spending on technology or cloud-based banking solutions or to seek to terminate or renegotiate their contracts with us. Moreover, economic fluctuations caused by factors such as the U.S. Federal Reserve changing interest rates may cause potential new customers and existing customers to forego or delay purchasing our solutions or reduce the amount of spend with us, which would materially and adversely affect our business.
Previous wording
We have a limited operating history at the current scale of our business, which makes it difficult to predict our future operating results, and we may not achieve our expected operating results in the future.
Current wording
Our future operating results are difficult to predict, in part because we do not have an extensive operating history at the current scale of our business, and we may not achieve our expected operating results in the future.
Previous wording
We began operations in late 2011 and have experienced net losses since inception. We generated net losses attributable to nCino of $49.4 million, $102.7 million, and $42.3 million for the fiscal years ended January 31, 2022, 2023, and 2024, respectively. Our net loss includes the results of operations of SimpleNexus from the date of acquisition on January 7, 2022. We had an accumulated deficit of $352.8 million at January 31, 2024. While we have been profitable on a GAAP basis for a quarter, we may not be able to maintain or increase our level of profitability. We intend to continue to support further growth and extend the functionality of our solutions in future periods. We will also face increased costs associated with growth and the expansion of our customer base and have seen increased costs in being a public company. Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses. We expect, depending on a number of factors, to continue to incur losses on a GAAP basis as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability on a GAAP basis. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.
Current wording
We began operations in late 2011 and have experienced net losses since inception. We generated net losses attributable to nCino of $102.7 million, $42.3 million, and $37.9 million for the fiscal years ended January 31, 2023, 2024, and 2025, respectively. We had an accumulated deficit of $385.3 million at January 31, 2025. While we have been profitable on a GAAP basis for a quarter, we may not be able to maintain or increase our level of profitability. We intend to continue to support further growth and extend the functionality of our solutions in future periods. We will also continue to face increased costs associated with growth and the expansion of our customer base and the costs of being a public company. Our continuing efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses. We expect, depending on a number of factors, to continue to incur losses on a GAAP basis as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability on a GAAP basis. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.
Previous wording
To increase our revenues, we will need to continue to attract new customers and succeed in having our current customers expand the use of our solutions across their institution. For example, our revenue growth strategy includes increased penetration of markets outside the U.S. as well as selling our retail applications to existing and new customers, and failure in either respect would adversely affect our revenue growth. In addition, for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions with us on the same or more favorable terms to us when their existing subscription term expires. Our revenue growth rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction with our solutions, decreases in the number of users at our customers, changes in the type and size of our customers, pricing changes, competitive conditions, the loss of our customers to other companies, and general economic conditions. Our customers may also require fewer subscriptions for our solutions as their use may enable them to operate more efficiently over time. Therefore, we cannot assure you that our current customers will renew or expand their use of our solutions. If we are unable to sign new customers or retain or attract new business from current customers, our business and results of operations may be materially and adversely affected.
Current wording
To increase our revenues, we will need to continue to attract new customers and succeed in having our current customers expand the use of our solutions across their institution. For example, our revenue growth strategy includes increased penetration of markets outside the U.S. as well as selling our solutions to existing and new customers, and failure in either respect would adversely affect our revenue growth. In addition, for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions with us on the same or more favorable terms to us when their existing subscription term expires. Our revenue growth rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction with our solutions, decreases in the number of users at our customers, changes in the type and size of our customers, pricing changes, competitive conditions, the loss of our customers to other companies, and general economic conditions. Our customers may also require fewer subscriptions for our solutions as their use may enable them to operate more efficiently over time. Therefore, we cannot assure you that our current customers will renew or expand their use of our solutions. If we are unable to sign new customers or retain or attract new business from current customers, our business and results of operations may be materially and adversely affected.
Previous wording
If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate or we fail to market our solutions effectively, our sales would suffer and our results of operations would be adversely affected.
Current wording
As the market for cloud-based banking technology continues to develop, it may do so more slowly than we expect or changes in a way that we fail to anticipate. If that occurs, or we fail to market our solutions effectively, our sales would suffer and our results of operations would be adversely affected.
Previous wording
Use of, and reliance on, cloud-based banking technology continues to evolve and we do not know whether FIs will continue to adopt cloud-based banking technology such as the nCino Bank Operating System in the future, or whether the market will change in ways we do not anticipate. Many FIs have invested substantial personnel and financial resources in legacy software, and these FIs may be reluctant, unwilling, or unable to convert from their existing systems to our solutions. Furthermore, these FIs may be reluctant, unwilling, or unable to use cloud-based banking technology due to various concerns, such as the security of their data and reliability of the delivery model. These concerns or other considerations may cause FIs to choose not to adopt cloud-based banking technology such as ours or to adopt them more slowly than we anticipate, either of which would adversely affect us. Our future success also depends on our ability to sell additional applications and functionality to our current and prospective customers. As we create new applications and enhance our existing solutions, these applications and enhancements may not be attractive to customers. In addition, promoting and selling new and enhanced functionality may require increasingly costly sales and marketing efforts and if customers choose not to adopt this functionality, our business and results of operations could suffer. If FIs are unwilling or unable to transition from their legacy systems, or if the demand for our solutions does not meet our expectations, our results of operations and financial condition will be adversely affected.
Current wording
Use of, and reliance on, cloud-based banking technology continues to evolve and we do not know whether FIs will continue to adopt cloud-based banking technology such as the nCino Platform in the future, or whether the market will change in ways we do not anticipate. Many FIs have invested substantial personnel and financial resources in legacy software, and these FIs may be reluctant, unwilling, or unable to convert from their existing systems to our solutions. Furthermore, these FIs may be reluctant, unwilling, or unable to use cloud-based banking technology due to various concerns, such as the security of their data and reliability of the delivery model. These concerns or other considerations may cause FIs to choose not to adopt cloud-based banking technology such as ours or to adopt them more slowly than we anticipate, either of which would adversely affect us. Our future success also depends on our ability to sell additional solutions and functionality to our current and prospective customers. As we create new solutions and enhance our existing solutions, these solutions and enhancements may not be attractive to customers. In addition, promoting and selling new and enhanced functionality may require increasingly costly sales and marketing efforts and if customers choose not to adopt this functionality, our business and results of operations could suffer. If FIs are unwilling or unable to transition from their legacy systems, or if the demand for our solutions does not meet our expectations, our results of operations and financial condition will be adversely affected.
Previous wording
Our revenues increased from $273.9 million for fiscal 2022 to $408.3 million for fiscal 2023 to $476.5 million for fiscal 2024. Our revenues include the revenues of SimpleNexus from the date of acquisition on January 7, 2022. However, we may not be able to sustain revenue growth consistent with our recent history, if at all. Our revenue growth in recent periods may not be indicative of our future performance. Furthermore, to the extent we grow in future periods, maintaining consistent rates of revenue growth may be difficult. Our revenue growth may also slow or even reverse in future periods due to a number of factors, which may include slowing demand for our solutions, our ability to successfully sell and implement new applications, such as our retail applications, increasing competition, decreasing growth of our overall market, our inability to attract and retain a sufficient number of FI customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions. If we are unable to maintain consistent revenue growth, our business could be adversely affected, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability.
Current wording
Our revenues increased from $408.3 million for fiscal 2023 to $476.5 million for fiscal 2024 and to $540.7 million for fiscal 2025. However, we may not be able to sustain revenue growth consistent with our recent history, if at all. Our revenue growth in recent periods may not be indicative of our future performance. Furthermore, to the extent we grow in future periods, maintaining consistent rates of revenue growth may be difficult. Our revenue growth may also slow or even reverse in future periods due to a number of factors, which may include slowing demand for our solutions, our ability to successfully sell and implement new solutions, such as our retail solutions, increasing competition, decreasing growth of our overall market, the adoption of our new asset-based pricing model, our inability to attract and retain a sufficient number of FI customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions. If we are unable to maintain consistent revenue growth, our business could be adversely affected, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability.
Previous wording
Our quarterly results of operations, including the levels of our revenues, gross margin, profitability, cash flow, and deferred revenue, may vary significantly in the future and, accordingly, period-to-period comparisons of our results of operations may not be meaningful. Thus, the results of any one quarter should not be relied upon as an indication of future performance. Our quarterly financial results may fluctuate as a result of a variety of factors, many of which are outside of our control, and may not fully or accurately reflect the underlying performance of our business. For example, purchases of our Paycheck Protection Program ("PPP") solution during the COVID pandemic may have had the effect of accelerating demand that might have otherwise materialized as new business in later periods as well as accelerating the activation of the licenses and recognition of subscription revenues associated with the PPP solution. Further, while subscriptions with our customers generally include multi-year non-cancellable terms, in a limited number of contracts, customers have an option to buy out of the contract for a specified termination fee. If such customers exercise this buy-out option, or if we negotiate an early termination of a contract at a customer’s request, any termination fee would be recognized in full at the time of termination, which would favorably affect subscription revenues in that period and unfavorably affect subscription revenues in subsequent periods. Fluctuation in quarterly results may negatively impact the value of our common stock. Factors that may cause fluctuations in our quarterly financial results include, without limitation, those listed below:
Current wording
Our quarterly results of operations, including the levels of our revenues, gross margin, profitability, cash flow, and deferred revenue, may vary significantly in the future and, accordingly, period-to-period comparisons of our results of operations may not be meaningful. Thus, the results of any one quarter should not be relied upon as an indication of future performance. Our quarterly financial results may fluctuate as a result of a variety of factors, many of which are outside of our control, and may not fully or accurately reflect the underlying performance of our business. Further, while subscriptions with our customers generally include multi-year non-cancellable terms, in a limited number of contracts, customers have an option to buy out of the contract for a specified termination fee. If such customers exercise this buy-out option, or if we negotiate an early termination of a contract at a customer’s request, any termination fee would be recognized in full at the time of termination, which would favorably affect subscription revenues in that period and unfavorably affect subscription revenues in subsequent periods. Fluctuation in quarterly results may negatively impact the value of our common stock. Factors that may cause fluctuations in our quarterly financial results include, without limitation, those listed below:
Previous wording
•increases or decreases in the number of users licensed or pricing changes upon renewals of customer contracts;
Current wording
•increases or decreases in the number of users licensed or pricing changes upon renewals of customer contracts (including as a result of our new asset-based pricing model);
Previous wording
Our customers have no obligation to renew their subscriptions for our solutions after the expiration of the initial or current subscription term, and our customers, if they choose to renew at all, may renew for fewer users or on less favorable pricing terms. The average initial term of our customer agreements is three to five years for the nCino Bank Operating System and one to three years for nCino Mortgage. We have a limited operating history at the current scale of our business with respect to rates of customer subscription renewals and cannot be certain of how actual renewal rates will compare to what we anticipate. Our renewal rates may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels. If our customers do not renew their subscriptions for our solutions on similar pricing terms, our revenues may decline and our business could suffer.
Current wording
Our customers have no obligation to renew their subscriptions for our solutions after the expiration of the initial or current subscription term, and our customers, if they choose to renew at all, may renew for fewer users or on less favorable pricing terms, particularly if they seek to negotiate alternatives to our asset-based pricing model. The historic average initial term of our customer agreements has been generally three to five years in length, billed annually in advance, and our fees and services have generally been non-cancelable and have not contained refund-type provisions. U.S. mortgage contracts are generally billed monthly in advance. Subscription arrangements that are cancelable generally have penalty clauses. Although we have observed some trends at our current scale with respect to customer subscription renewals, we cannot be certain of how actual renewal rates will compare to what we anticipate. Our renewal rates may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels.
Previous wording
Additionally, as the markets for our solutions develop, we may be unable to attract new customers based on the same subscription model we have used historically. Moreover, large or influential FI customers may demand more favorable pricing or other contract terms from us. As a result, we may in the future be required to change our pricing model, reduce our prices, or accept other unfavorable contract terms, any of which could adversely affect our revenues, gross margin, profitability, financial position, and/or cash flow.
Current wording
In addition, large or influential FI customers may demand more favorable pricing or other contract terms from us. As a result, we may in the future be required to implement further changes to our pricing model, reduce our prices, or accept other unfavorable contract terms, any of which could adversely affect our revenues, gross margin, profitability, financial position, and/or cash flow.
Previous wording
Our business faces significant risks from diverse security threats. A breach of our security measures or those we rely on could result in unauthorized access to customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.
Current wording
Our business faces significant risks from diverse security threats. A breach of our security or privacy measures or those we rely on could result in unauthorized access to, or disclosure of, customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.
Previous wording
Certain elements of our solutions, particularly our analytics applications, process and store personally identifiable information (“PII”) such as banking and personal information of our customers’ clients, and we may also have access to PII during various stages of the implementation process or during the course of providing customer support. Furthermore, as we develop or acquire additional functionality, such as nCino Mortgage, we may gain greater access to PII. We maintain policies, procedures, and technological safeguards designed to protect the confidentiality, integrity, and availability of this information and our information technology systems. However, we and our third party service providers, frequently defend against and respond to data security incidents. We cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of PII or other security events that impact the integrity or availability of PII or our systems and operations, or the related costs we may incur to mitigate the consequences from such events. Further, our products are flexible and complex software solutions and there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches. There may be continued unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations. In addition, because we leverage third-party providers, including cloud, software, data center, and other critical technology vendors to deliver our solutions to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers. A vulnerability in a third-party provider’s software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions.
Current wording
Certain elements of our solutions, particularly our analytics and mortgage solutions, process and store personally identifiable information (“PII”), such as banking and personal information of our customers’ clients, and we may also have access to PII during various stages of the implementation process or during the course of providing customer support. Furthermore, as we develop or acquire additional functionality, we may gain greater access to PII. We maintain policies, procedures, and technological safeguards designed to protect the confidentiality, integrity, and availability of this information and our information technology systems. However, we and our third party service providers, frequently defend against and respond to data security incidents. We cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of PII or other security or privacy events that impact the integrity or availability of PII or our systems and operations, or the related costs we may incur to mitigate the consequences from such events. Further, our products are flexible and complex software solutions and there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches. There may be continued unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations.
Previous wording
Cyberattacks and other malicious internet-based activity, including increased threats from the use of artificial intelligence, continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, employee theft or misuse, and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, discovery of existing or new vulnerabilities, and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions. In the event our or our third-party providers’ protection efforts are unsuccessful and our systems or solutions are compromised, we could suffer substantial harm. A security breach could result in operational disruptions, loss, compromise or corruption of customer or client data or data we rely on to provide our solutions, including our analytics initiatives and offerings that impair our ability to provide our solutions and meet our customers’ requirements resulting in decreased revenues and otherwise materially negatively impacting our financial results. Also, our reputation could suffer irreparable harm, causing our current and prospective customers to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and protection technologies, and defending against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations.
Current wording
Cyberattacks and other malicious internet-based activity, including increased threats from the use of AI, continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, employee theft or misuse, and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, discovery of existing or new vulnerabilities, and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions. In the event our or our third-party providers’ protection efforts are unsuccessful and our systems or solutions are compromised, we could suffer substantial harm. A security breach could result in operational disruptions, loss, compromise or corruption of customer or client data or data we rely on to provide our solutions, including our analytics initiatives and offerings that impair our ability to provide our solutions and meet our customers’ requirements resulting in decreased revenues and otherwise materially negatively impacting our financial results. Also, our reputation could suffer irreparable harm, causing our current and prospective customers to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and protection technologies, and defending against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations.
Previous wording
Federal and state regulations may require us or our customers to notify individuals of data security incidents involving certain types of personal data or information technology systems, and those laws and regulations continue to evolve to add more reporting requirements on faster timelines. Security compromises experienced by others in our industry, our customers, or us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew or expand their use of our solutions, or subject us to third-party lawsuits, regulatory fines, or other actions or liabilities, which could materially and adversely affect our business and results of operations.
Current wording
Federal and state regulations may require us or our customers to notify individuals of data security or privacy incidents involving certain types of personal data or information technology systems, and those laws and regulations continue to evolve to add more reporting requirements on faster timelines. Security compromises experienced by others in our industry, our customers, or us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew or expand their use of our solutions, or subject us to third-party lawsuits, regulatory fines, or other actions or liabilities, which could materially and adversely affect our business and results of operations.
Previous wording
Fundamental elements of the nCino Bank Operating System are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.
Current wording
Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.
Previous wording
Fundamental elements of the nCino Bank Operating System, including our client onboarding, loan origination, and deposit account opening applications, are built on the Salesforce Platform and we rely on our agreement with Salesforce to use the Salesforce Platform in conjunction with this solution, including for hosting infrastructure and data center operations. Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model.
Current wording
Fundamental elements of the nCino Platform, including our client onboarding, loan origination, and deposit account opening solutions, are built on the Salesforce Platform and we rely on our agreement with Salesforce to use the Salesforce Platform in conjunction with these solutions, including for hosting infrastructure and data center operations. Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model.
Previous wording
Our agreement with Salesforce expires on January 31, 2031, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and automatically renews for additional one-year periods thereafter unless notice of non-renewal is provided. If we are unable to renew our agreement with Salesforce, there would be, absent a termination for cause, a wind-down period during which existing customers would be able to continue using the nCino Bank Operating System in conjunction with the Salesforce Platform, but we would be unable to provide this solution to new customers and could be limited in our ability to allow current customers to add additional users. In addition, if we are unable to renew our agreement with Salesforce, our customers would need to obtain a separate subscription from Salesforce in order to access the nCino Bank Operating System. This could cause a significant delay in the time required to enter into agreements with customers, place us and our customers at a disadvantage in negotiating with Salesforce, and lead customers not to renew or enter into agreements with us. We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if they are not, our business and operating results may be materially and adversely affected.
Current wording
Our agreement with Salesforce expires on January 31, 2031, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and thereafter automatically renews for additional one-year periods unless notice of non-renewal is provided by either party. If we are unable to renew our agreement with Salesforce, there would be, absent a termination for cause, a wind-down period during which existing customers would be able to continue using the nCino Platform in conjunction with the Salesforce Platform, but we would be unable to provide this solution to new customers and could be limited in our ability to allow current customers to add additional users. In addition, if we are unable to renew our agreement with Salesforce upon its expiration, our customers would need to obtain a separate subscription from Salesforce in order to access the nCino Platform. This could cause a significant delay in the time required to enter into agreements with customers, place us and our customers at a disadvantage in negotiating with Salesforce, and lead customers not to renew or enter into agreements with us. We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if they are not, our business and operating results may be materially and adversely affected.
Previous wording
In addition, Salesforce has the right to terminate their agreement with us in certain circumstances, including in the event of a material breach by us. If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above. We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Bank Operating System infringes the intellectual property rights of such third party.
Current wording
In addition, Salesforce has the right to terminate their agreement with us in certain circumstances, including in the event of a material breach by us. If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above. We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Platform infringes the intellectual property rights of such third party.
Previous wording
An expiration or termination of our agreement with Salesforce would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Bank Operating System to become obsolete. Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different product. If we were unsuccessful in acquiring or developing a replacement solution or acquire or develop a replacement solution that our customers do not adopt, our business, results of operations, and brand would be materially and adversely affected.
Current wording
An expiration or termination of our agreement with Salesforce would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Platform to become obsolete. Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different solution. If we were unsuccessful in acquiring or developing a replacement solution or acquire or develop a replacement solution that our customers do not adopt, our business, results of operations, and brand would be materially and adversely affected.
Previous wording
We expect that there will continue to be new proposed and adopted laws, regulations, and industry standards concerning privacy, data protection, and information security in the U.S., the EU, and other jurisdictions in which we operate. For instance, the California Consumer Privacy Act (the "CCPA") became effective on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, receive detailed information about how their personal information is used and shared by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined), and provide such consumers rights to opt-out of certain sales of personal information. The CCPA provides for potential civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The California Privacy Rights Act (the "CPRA"), which expands the CCPA, passed in November 2020 and went into effect on January 1, 2023, potentially requiring still to be determined additional compliance investment and potential business process changes. Among other things, the CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement. Additionally, other U.S. states are proposing and enacting laws and regulations that impose obligations similar to the CCPA or that otherwise involve significant obligations and restrictions. If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.
Current wording
We expect that there will continue to be new proposed and adopted laws, regulations, and industry standards concerning privacy, data protection, and information security in the U.S., the EU, and other jurisdictions in which we operate. For instance, the California Consumer Privacy Act (the "CCPA") became effective on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, receive detailed information about how their personal information is used and shared by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined), and provide such consumers rights to opt-out of certain sales of personal information. The CCPA provides for potential civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The California Privacy Rights Act (the "CPRA"), which expands the CCPA, passed in November 2020 and went into effect on January 1, 2023, potentially requiring still to be determined additional compliance investment and potential business process changes. Among other things, the CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement. The CCPA includes a number of limited exceptions, including an exception for data that is collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley-Act (“GLBA”) and an exemption that includes some types of data covered by the Fair Credit Recording Act (“FCRA”). These exceptions, however, do not apply to the private cause of action afforded to individuals for negligent information security incidents. Additionally, the CCPA applies to the personal information of California residents collected in the employment, job applicant and business-to-business settings.
Previous wording
Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination and security of personally identifiable information, including financial information. Actual, potential, or perceived violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies and processing of personal data, as well as civil claims including class actions, reputational damage and ongoing compliance costs, any of which could harm our business, results of operations and financial condition. Moreover, federal, and state regulation around artificial intelligence may be expected in the near future, including developments in response to the recent Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence issued on October 30, 2023.
Current wording
Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination and security of personally identifiable information, including financial information. Actual, potential, or perceived violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies and processing of personal data, as well as civil claims including class actions, reputational damage and ongoing compliance costs, any of which could harm our business, results of operations and financial condition. Moreover, federal, and state regulation around AI may be enacted in the near future.
Previous wording
In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism in accordance with the EU GDPR has been put in place or a derogation under the EU GDPR can be relied on. In July 2020, the Court of Justice of the European Union (the "CJEU") in its Schrems II ruling invalidated the EU-U.S. Privacy Shield framework, a self-certification mechanism that facilitated the lawful transfer of personal data from the EEA to the U.S., with immediate effect. The CJEU upheld the validity of standard contractual clauses ("SCCs") as a legal mechanism to transfer personal data but companies relying on SCCs will need to carry out a transfer privacy impact assessment ("TIA") which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA. The EU and U.S. governments have recently advanced the EU-U.S. Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision, but it is uncertain whether this framework will be overturned in court like the previous two EU-U.S. bilateral cross-border transfer mechanism to replace the EU-US Privacy Shield framework. The UK GDPR imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK does not consider adequate. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. The UK Information Commissioner's Office ("ICO") has also published its own version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK-style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data bridge ("UK Adequacy Regulations"). Personal data may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF. This may have implications for our cross-border data flows and may result in additional compliance costs.
Current wording
In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism in accordance with the EU GDPR has been put in place (e.g., Standard Contractual Clauses or “SCCs”) or a derogation under the EU GDPR can be relied on. In certain cases (e.g. where transfers are made in reliance on SCCs) it is also necessary to carry out a transfer impact assessment ("TIA") which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA. On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the U.S. adequacy (“Adequacy Decision”) for EU-US transfers of personal data for entities self-certified to the EU-US Data Privacy Framework (“DPF”). Entities relying on EU SCCs for transfers to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress.
Previous wording
The GDPR also introduces fines of up to €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, for serious violations of certain of the GDPR’s requirements. The GDPR identifies a list of points to consider when determining the level of fines to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation for financial or non-financial losses (e.g., distress). Complying with the GDPR may cause us to incur substantial operational and compliance costs or require us to change our business practices. Despite our efforts to bring practices into compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, regulators, customers, data subjects, suppliers, vendors or other parties. Further, there is a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the new procedures. If there are breaches of these measures, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects.
Current wording
Data protection supervisory authorities have the power under the GDPR to (amongst other things) impose fines of up to €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, for serious violations of certain of the GDPR’s requirements. Data subjects also have a right to compensation, as a result of an organization's breach of the GDPR which has affected them for financial or non-financial losses (e.g., distress). Complying with the GDPR may cause us to incur substantial operational and compliance costs or require us to change our business practices. Despite our efforts to bring practices into compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, regulators, customers, data subjects, suppliers, vendors or other parties. Further, there is a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the new procedures. If there are breaches of these measures, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects.
Previous wording
On January 17, 2023, the EU Network and Information Systems Security 2 Directive (“NISD2”) entered into force and will take full effect following implementation into EU Member State law (i.e., by October 17, 2024). Under the NISD2, more stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers.
Current wording
On January 17, 2023, the EU Network and Information Systems Security 2 Directive (“NISD2”) entered into force. Member States had until October 17, 2024 to transpose NISD2 into EU Member State law. The European Commission initiated infringement procedures, by sending letters of formal notice to 23 Member States for failing to fully transpose NISD2 by this deadline. Under the NISD2, stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers.
Previous wording
On January 16, 2023, the EU Digital Operational Resilience Act (“DORA”) entered into force and will apply from January 17, 2025. DORA imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers. DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered ‘critical’ within the meaning of DORA. Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with ICT third-party service providers.
Current wording
The EU Digital Operational Resilience Act (“DORA”), which applied from January 17, 2025, imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers. DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered ‘critical’ within the meaning of DORA. Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with ICT third-party service providers.
Previous wording
We may also face competition from new companies entering our markets, which may include large established businesses that decide to develop, market or resell cloud-based banking technology, acquire one of our competitors or form a strategic alliance with one of our competitors or with Salesforce. In addition, new companies entering our markets may choose to offer cloud-based banking applications at little or no additional cost to the customer by bundling them with their existing applications, including adjacent banking technologies. Competition from these new entrants may make attracting new customers and retaining our current customers more difficult, which may adversely affect our results of operations.
Current wording
We may also face competition from new companies entering our markets, which may include large established businesses that decide to develop, market or resell cloud-based banking technology, acquire one of our competitors or form a strategic alliance with one of our competitors or with Salesforce. In addition, new companies entering our markets may choose to offer cloud-based banking solutions at little or no additional cost to the customer by bundling them with their existing solutions, including adjacent banking technologies. Competition from these new entrants may make attracting new customers and retaining our current customers more difficult, which may adversely affect our results of operations.
Previous wording
If we are unable to compete in this environment, sales and renewals of the nCino Bank Operating System could decline and adversely affect our business and results of operations. With the introduction of new technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability.
Current wording
If we are unable to compete in this environment, sales and renewals of the nCino Platform could decline and adversely affect our business and results of operations. With the introduction of new technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability.
Previous wording
Our increased focus on the development and use of artificial intelligence and machine learning technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.
Current wording
Our increased focus on the development and use of AI/ML technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.
Showing the first 40 of 60 pairs. Open the source sections for the rest.
Rearranged current paragraphs (4)
Current report — wording carried from elsewhere
In addition, because we leverage third-party providers, including cloud, software, data center, and other critical technology vendors to deliver our solutions to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers. A vulnerability in a third-party provider’s software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions.
Current report — wording carried from elsewhere
Twenty U.S. states have enacted comprehensive privacy laws and several others are proposing and enacting laws and regulations that impose obligations similar to the CCPA or that otherwise involve significant obligations and restrictions. Although many such state laws do not apply to FIs (or to data) subject to the GLBA, and some exempt all commercial- and employment-related data, these are evolving laws and regulations that add layers of complexity to compliance in the U.S. market. If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.
Current report — wording carried from elsewhere
The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK government does not consider adequate. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new SCCs. The UK Information Commissioner's Office ("ICO") has also published its own version of the TIA, although entities may choose to adopt either the EU or UK-style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data bridge. Personal data may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF. This may have implications for our cross-border data flows and may result in additional compliance costs.
Current report — wording carried from elsewhere
Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend.