Q2 Holdings (QTWO) Risk Factors

The markets for our solutions are characterized by rapid technological advancements, changes in customer requirements and technologies, frequent new product introductions and enhancements and changing regulatory requirements. The life cycles of our solutions are difficult to estimate. Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large financial services providers could undermine our current market position. Other means of digital financial services solutions may be developed or adopted in the future, and our solutions may not be compatible with these new technologies. In addition, the technological needs of, and services provided by, customers may change if they or their competitors offer new services to End Users. Maintaining adequate research and development resources to meet the demands of the markets we serve is essential. The process of developing new technologies and solutions is complex and expensive. The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective. The success of any enhanced or new solution depends on several factors, including timely completion, adequate testing and market release and acceptance of the solution. Any new solutions that we develop or acquire may not be introduced in a timely or cost-effective manner, may contain defects or may not achieve the broad market acceptance necessary to generate significant revenues. In addition, the operational constraints placed on our business as a result of the COVID-19 pandemic may adversely impact our ability to bring to new solutions to market in a timely manner. If we are unable to anticipate customer requirements or work with our customers successfully on implementing new solutions or features in a timely manner or enhance our existing solutions to meet our customers' requirements, our business and operating results may be adversely affected.

Certain elements of our solutions process and store personally identifiable information, or PII, such as banking and personal information of our customers and their End Users, and we also may have access to PII during various stages of the implementation process or during the course of providing customer support. Furthermore, as we develop additional functionality, we may gain greater access to PII. We maintain policies, procedures and technological safeguards designed to protect the confidentiality, integrity and availability of this information and our information technology systems. However, we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of PII or other security events that impact the integrity or availability of PII or our systems and operations, or the related costs we may incur to mitigate the consequences from such events. Further, given the flexibility and complexity of our solutions, there is a risk that configurations of, or defects in, the solutions or errors in implementation could create vulnerabilities to security breaches. There may be unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their End Users that may disrupt our or our customers' operations. In addition, because we leverage third-party providers, including cloud, software, data center and other critical technology vendors to deliver our solution to our customers and their End Users, we rely heavily on the data security technology practices and policies adopted by these third-party providers. A vulnerability in a third-party provider's software or systems, a failure of our third-party providers' safeguards, policies or procedures, or a breach of a third-party provider's software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our solutions. Our security measures and the security measures of our customers or third-party providers on whom we rely may not be sufficient to prevent our systems from being compromised as a result of third-party action, the error or intentional misconduct of employees, customers or their End Users, malfeasance or stolen or fraudulently obtained login credentials. Security incidents can result in unauthorized access to, loss of or unauthorized disclosure of this information, litigation, indemnity obligations and other possible liabilities, as well as negative publicity, which could damage our reputation, impair our sales and harm our business. Cyber-attacks, ransomware attacks, account take-over attacks, fraudulent representations and other malicious Internet-based activity continue to increase and evolve and financial services providers, their End Users, and technology providers are often targets of such attacks. In addition to traditional computer "hackers," malicious code (such as viruses and worms), phishing, employee theft or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, discovery of existing or new vulnerabilities, and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions. In addition, third parties may attempt to fraudulently induce our employees or the employees of our customers or third-party providers into disclosing sensitive information such as usernames, passwords or other information to gain access to our confidential or proprietary information or the data of our customers and their End Users. A party who is able to compromise the security of our facilities could cause interruptions or malfunctions in our operations. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or sabotage systems because they change frequently and generally are not detected until after an incident has occurred. As we increase our customer base and our brand becomes more widely known and recognized, we may become more of a target for third parties seeking to compromise our security systems or gain unauthorized access to the data of our customers and their End Users. In addition, there may be an increased risk of cyber-attacks or cyber fraud related to the COVID-19 pandemic, as cybercriminals attempt to profit from the disruption, given increased online banking, e-commerce and other online activity. Additionally, there is an increased risk that we may experience cybersecurity-related events such as COVID-19 themed phishing attacks and other security challenges as a result of most of our employees and our service providers working remotely from non-corporate managed networks during the ongoing COVID-19 pandemic and potentially continuing working remotely even after the COVID-19 pandemic has subsided. A failure or inability to meet our customers' expectations with respect to security and confidentiality could seriously damage our reputation and affect our ability to retain customers and attract new business. Federal, state and other regulations may require us to notify customers and their End Users of data security incidents involving certain types of personal data. Security compromises experienced by our competitors, by our customers or by us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could materially and adversely affect our business and operating results. In addition, some of our customers contractually require notification of any data security compromise and include representations and warranties that our solutions comply with certain regulations related to data security and privacy. Although our customer agreements typically include limitations on our potential liability, there can be no assurance that such limitations of liability would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. We also cannot be sure that our existing general liability insurance coverage and coverage for errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more claims, or that our insurers will not deny or attempt to deny coverage as to any future claim. The successful assertion of one or more claims against us, the inadequacy of or denial of coverage under our insurance policies, litigation to pursue claims under our policies or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, financial condition and results of operations.

We currently compete with providers of technology and services in the financial services industry, including point system vendors and core processing vendors, as well as systems internally-developed by financial services providers. With respect to our digital banking platform, we have a number of point system competitors, including NCR Corporation, or NCR, First Data Corporation (acquired by Fiserv, Inc. in July 2019), D3 Technology, Inc. (acquired by NCR in July 2019), Alkami Technology, Inc. and Kony, Inc. (acquired by Temenos AG in September 2019) in the online, consumer and small business banking space and Finastra, ACI Worldwide, Inc. and Bottomline Technologies (de), Inc. in the commercial banking space. We also compete with core processing vendors that provide systems and services such as Fiserv, Inc., Jack Henry and Associates, Inc. and Fidelity National Information Services, Inc., or FIS. With respect to our lending and leasing platform, we compete against a number of point system competitors, including Abrigo, Baker Hill Solutions, LLC, Fair Isaac Corporation, nCino, Inc., Finastra, Moody's Analytics, Inc., Oracle Corporation, Temenos AG, and core processing vendors, including FIS and Fiserv. With respect to our BaaS solutions, due to the vast number of potential use cases and customer segments, the list of potential competitors is extremely broad and varied, but includes companies across the retail banking, financial services, transaction processing, consumer technology and financial technology services industries. Many of our competitors have significantly more financial, technical, marketing and other resources than we have, may devote greater resources to the promotion, sale and support of their systems than we can, have more extensive customer bases and broader customer relationships than we have and have longer operating histories and greater name recognition than we have. In addition, many of our competitors expend more funds on research and development. In the uncertain economic environment caused by COVID-19, many of our competitors may have greater liquidity and access to capital than we do and may respond to market conditions by lowering prices to compete for customers, the impact of which could adversely impact our business and financial results. We also may face competition from new companies entering our markets, which may include large established businesses that decide to develop, market or resell competitive solutions, acquire one of our competitors or form a strategic alliance with one of our competitors. In addition, new companies entering our markets may choose to offer competitive solutions at little or no additional cost to the customer by bundling them with their existing applications, including adjacent financial services technologies and core processing software. New entrants to the markets we serve might also include financial services providers developing financial services solutions and other technologies, including solutions built using competing BaaS solutions or open API platforms. Competition from these new entrants may make our business more difficult and adversely affect our results. If we are unable to compete in this environment, sales and renewals of our solutions could decline and adversely affect our business, operating results and financial condition. With the introduction of new technologies and potential new entrants into the markets for our solutions, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability. In addition, we may face increased competition in our existing markets as we enter new markets or sections of a market with larger or different customers and new solutions. Our industry has also experienced recent consolidation which we believe may continue. Any further consolidation our industry experiences could lead to increased competition and result in pricing pressure or loss of market share, either of which could have a material adverse effect on our business, limit our growth prospects or reduce our revenues.

We may become subject, from time to time, to legal proceedings and claims that arise in the ordinary course of business such as claims brought by our customers in connection with commercial or intellectual property disputes or employment claims made by our current or former employees, including as a result of actions taken by us in response to the COVID-19 pandemic. Litigation might result in substantial costs and may divert management's attention and resources, which might seriously harm our business, overall financial condition and operating results. Insurance may not cover such claims, provide sufficient payments to cover all the costs to resolve one or more such claims or continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs and impact our liquidity, thereby reducing our operating results and impacting our financial condition, leading analysts and investors to reduce their confidence and expectations and reduce the trading price of our stock.

We file sales and other tax returns within the U.S. and foreign jurisdictions as required by law and certain customer contracts for a portion of the solutions that we provide. Our tax liabilities with respect to sales and other taxes in various jurisdictions was approximately $1.1 million as of September 30, 2020. From time to time, we face sales and other tax audits, and we will likely continue to do so in the future, and our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to such authorities. We do not collect sales or other similar taxes in other states or jurisdictions and some jurisdictions do not apply sales or similar taxes to certain solutions. State, local and foreign taxing jurisdictions have differing rules and regulations governing sales and other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of sales taxes to our solutions in various jurisdictions is unclear. We review these rules and regulations periodically and, when we believe we are subject to sales and other taxes in a particular jurisdiction, we may voluntarily engage tax authorities to determine how to comply with their rules and regulations. A successful assertion by one or more jurisdictions, including those for which we have not accrued tax liability, requiring us to collect sales or other taxes with respect to sales of our solutions or customer support could result in substantial tax liabilities for past transactions, including interest and penalties, discourage customers from purchasing our solutions or otherwise harm our business and operating results.

We rely on hardware and services that we purchase or lease and software, including open source software, that we develop or license from, or that is hosted by third parties, to offer our solutions. In addition, we obtain licenses from third parties to use intellectual property associated with the development of our solutions. These licenses might not continue to be available to us on acceptable terms, or at all. These third-party providers have chosen and may in the future choose not to continue to support certain of the hardware, software or services we license. We also have chosen and may in the future choose to discontinue the use of the hardware, services or software we acquire or license from such third-party providers, which may require that we pay termination fees or recognize related accounting charges or impairments. Additionally, these third-party providers of hardware, services and software have been, and may continue to be negatively impacted or cease operating as a result of operational and economic challenges triggered by the COVID-19 pandemic. While we are not substantially dependent upon any third-party hardware, services or software, the loss of the right or ability to use all or a significant portion of our third-party hardware, services or software required for the development, maintenance and delivery of our solutions could result in delays in the provision of our solutions until we develop or identify, obtain and integrate equivalent technology, which could harm our business. Any errors or defects in the hardware, services or software we use could result in errors, interruptions or a failure of our solutions. Although we believe that there are alternatives, any significant interruption in the availability of all or a significant portion of such hardware, services or software, including as a result of disruptions or increased demand resulting from the COVID-19 pandemic, could have an adverse impact on our business unless and until we can replace the functionality provided by these products at a similar cost. Furthermore, such hardware, services and software may not be available on commercially reasonable terms, or at all. The loss of the right to use all or a significant portion of such hardware, services or software could limit access to our solutions. Additionally, we rely upon third parties' abilities to enhance their current products, develop new products on a timely and cost-effective basis and respond to emerging industry standards and other technological changes. We may be unable to effect changes to such third-party technologies, which may prevent us from rapidly responding to evolving customer requirements. We also may be unable to replace the functionality provided by the third-party software currently offered in conjunction with our solutions in the event that such software becomes obsolete or incompatible with future versions of our solutions or is otherwise not adequately maintained or updated.

Global health concerns stemming from the COVID-19 pandemic and related government actions have caused significant disruption to the global economic environment. The pandemic has significantly increased economic uncertainty and reduced economic activity, including consumer and business spending. In response to the pandemic, government authorities have implemented numerous measures to try to contain the spread of the disease, including travel bans and restrictions, quarantines, shelter-in-place or total lock-down orders and business limitations and shutdowns. The COVID-19 pandemic is adversely impacting our customers and our business, but the extent of such impacts is highly uncertain and difficult to predict. While we believe that to date our business continuity and pandemic plans are operating effectively and that we have been able to operate and provide services to our customers under the circumstances, if we are not able to respond to and manage these impacts and related changes effectively, our business, results of operations, liquidity and financial condition will continue to be adversely impacted. Moreover, even after the pandemic has subsided, we may continue to experience materially adverse impacts to our business, results of operation and financial condition as a result of the virus' global economic impact, including reduced spending, lower economic activity and weakened banking and financial systems. For example, the spread of COVID-19 has caused us to modify our business practices (including restricting employee travel, developing social distancing plans for our employees and cancelling physical participation in meetings, events and conferences), and we may take further actions as may be required by government authorities or as we determine are in the best interests of our employees, customers and business partners. There is no certainty that such measures will be sufficient to mitigate the risks posed by the virus or will otherwise be satisfactory to government authorities. Nearly all of our employees are currently working remotely and have been since early March 2020 due to government work and travel restrictions, and we currently plan to remain operating virtually at least through the remainder of 2020. These decisions may impair or delay our ability to sell our solutions, adversely impact our product development and harm productivity and collaboration. While we believe these actions were reasonable and necessary as a result of the COVID-19 pandemic, they have resulted in disruptions to our normal business operations. In addition, the COVID-19 pandemic and the resulting weakening of the global economy, rapid increase in unemployment rates, declines in interest rates and reductions in business confidence and activity, have had a significant impact on our financial institution, Alt-FI and FinTech customers, as well as the End User businesses and individuals that utilize our customers' services. These conditions may affect the rate of technology spending and influence the timing of our customers' and prospective customers' technology purchasing and implementation decisions, which could adversely affect our customers' and prospective customers' ability or willingness to purchase our solutions, delay prospective customers' purchasing decisions, reduce the value or duration of their subscriptions, negatively affect our renewal rates and churn or result in a decrease in the number of End Users of our solutions or the transactions performed using our solutions, each of which is difficult to predict and any of which could adversely affect our operating results and financial condition on both a short-term and long-term basis. For example, we have experienced and expect to continue to experience delayed implementations as a result of the COVID-19 pandemic as our customers focus on other initiatives in response to the COVID-19 pandemic and manage their own operations in light of the pandemic. In addition, while we believe the COVID-19 pandemic will increase the importance and prominence of digital financial solutions, likely resulting in increased registration of new End Users with existing Installed Customers and the retention of certain customers that may have otherwise not renewed their contracts, the increased economic uncertainty and reduced economic activity, including consumer and business spending, is resulting in delays in certain purchasing decisions and implementations, which may delay bookings and our recognition of revenue. We believe this delay in bookings has been and will continue to be most significant (relative to our expectations prior to the COVID-19 pandemic) with respect to our data-driven sales enablement and portfolio management lending solutions particularly with respect to enterprise customers, because the target customers for these solutions have focused their internal resources on responding to the COVID-19 pandemic, including by providing loans through government stimulus programs such as the federal "Paycheck Protection Program." Further, with recent increases in COVID-19 cases in Europe and corresponding additional shelter-in-place and similar restrictions, we expect to see a continued negative impact in the near term on bookings from the sale of our digital lending and leasing solutions to European-based customers. We have experienced a less significant overall bookings impact (relative to our expectations prior to the COVID-19 pandemic) with respect to our digital banking solutions. We have, however, experienced a significant slowing of net new customer deals, partially offset by an increase in cross sales of additional features and functionality to our existing customer base due to the increased utilization and demand for digital banking solutions caused by the decreased in-branch operations resulting from the COVID-19 pandemic. During the quarter ended June 30, 2020, the negative impact to bookings and revenue from the sale of our Cloud Lending digital lending and leasing solutions was significantly offset by our sales and implementation of new offerings of these solutions designed to facilitate loans under the "Paycheck Protection Program" and similar government stimulus programs in the U.S. and abroad. We did not experience similar benefits to revenues or bookings from stimulus programs in the quarter ended September 30, 2020 and do not currently expect any similar future revenues or bookings impacts related to stimulus programs or benefits. Given the uncertainty that still surrounds COVID-19 and the November 2020 elections, we are expecting sales performance across all our solutions to be slower than normal during the quarter ended December 31, 2020 and for the foreseeable future. The impact of the COVID-19 pandemic also has and may continue to delay customer decisions with respect to contract extensions and may result in certain downgrades and cancellations from existing customers. For example, we have experienced and expect to continue to experience certain customers requesting reduced or extended payment terms to assist them with cost reduction measures as a result of the COVID-19 pandemic, which we intend to make conditional on associated contract extensions to offset the impact of the reduced payments. We also have and could continue to experience contract terminations with customers who become insolvent as a result of the COVID-19 pandemic. Other factors related to the COVID-19 pandemic that may adversely impact our business operations include: - challenges to our operations and our ability to meet customer service level commitments due to government shelter-in-place or other orders under which we are not able to provide certain customer-facing services remotely, which may cause potential loss of revenue or contractual penalties, as well as associated costs resulting from potential legal disputes regarding force majeure or other related contract defenses;- service interruptions or impaired system performance due to failures of or delays in our systems or resources as a result of increased online banking activity related to End Users utilizing digital banking services while subject to government shelter-in-place or similar orders, or increased use of our solutions resulting from government stimulus programs;- changes to our normal operations, including as a result of increased remote working and the possibility that one or more clusters of COVID-19 cases could occur at one of our locations, data centers or other third-party providers, affecting our employees or affecting the systems or employees of our customers or other third parties on which we depend;- risks, including public and private litigation, based upon, arising out of or related to COVID-19 and our actions and responses thereto, including any actions that we may take in connection with re-opening our offices where permitted by local law;- an increase in the volume of customer and regulatory requests for information and support; and - increased cyber fraud risk related to increased online banking, e-commerce and other online activity. There are no comparable recent events that provide guidance as to the effect the spread of COVID-19 as a global pandemic may have, and, as a result, the ultimate impact of the pandemic is highly uncertain and subject to change. We do not yet know the full extent of the impacts on our business, our operations or the global economy as a whole. However, the effects could have a material adverse effect on our results of operations, liquidity or financial condition and heighten many of the known risks with respect to our business and ownership of our securities, which are described further in this "Risk Factors" section.

We have international operations in India, Australia, the United Kingdom, and the Netherlands. We also expect to continue to expand our international operations for the foreseeable future. The continued international expansion of our operations requires significant management attention and financial resources and results in increased administrative and compliance costs. Our limited experience in operating our business in certain regions outside the United States increases the risk that our expansion efforts into those regions may not be successful. In particular, our business model may not be successful in particular countries or regions outside the United States for reasons that we currently are unable to anticipate. In addition, conducting international operations subjects us to risks that we have not generally faced in the United States. These include, but are not limited to: - fluctuations in currency exchange rates;- the complexity of, or changes in, foreign regulatory requirements;- the cost and complexity of bringing our solutions into compliance with foreign regulatory requirements, and risks of our solutions not being compliant;- difficulties in managing the staffing of international operations, including compliance with local labor and employment laws and regulations;- complexities implementing and enforcing cross-border information technology and security controls;- potentially adverse tax consequences, including the complexities of foreign value added tax systems, overlapping tax regimes, restrictions on the repatriation of earnings and changes in tax rates;- dependence on resellers and distributors to increase customer acquisition or drive localization efforts;- the burdens of complying with a wide variety of foreign laws and different legal standards, including shelter-in-place and similar orders imposed by foreign regulatory authorities in response to the COVID-19 pandemic, certain of which may be significantly more burdensome than those in place in the United States;- increased financial accounting and reporting burdens and complexities;- longer payment cycles and difficulties in collecting accounts receivable;- longer sales cycles;- political, social and economic instability abroad, including as a result of the COVID-19 pandemic;- terrorist attacks and security concerns in general;- integrating personnel with diverse business backgrounds and organizational cultures;- difficulties entering new non-U.S. markets due to, among other things, consumer acceptance and business knowledge of these new markets;- travel restrictions imposed in response to the COVID-19 pandemic;- constraints or remote working by employees during the COVID-19 pandemic due to limitations of local infrastructure or other resources;- reduced or varied protection for intellectual property rights in some countries; and - the risk of U.S. regulation of foreign operations. The occurrence of any one of these risks could negatively affect our international business and, consequently, our operating results. We cannot be certain that the investment and additional resources required to establish, acquire or integrate operations in other countries will produce desired levels of revenue or profitability. If we are unable to effectively manage our expansion into additional geographic markets, our financial condition and results of operations could be harmed. In particular, we operate some of our research and development activities internationally and outsource a portion of the coding and testing of our products and product enhancements to contract development vendors. We believe that performing research and development in our international facilities and supplementing these activities with our contract development vendors enhances the efficiency and cost-effectiveness of our product development. If we experience problems with our workforce or facilities internationally, including as a result of work limitations resulting from the COVID-19 pandemic, we may not be able to develop new products or enhance existing products in an alternate manner that may be equally or less efficient and cost-effective. In addition, if information technology and security controls we have implemented to address risks posed by research and development activities outside of the United States are breached or are otherwise ineffective, our intellectual property or technical infrastructure could be compromised or stolen. We are monitoring developments related to the United Kingdom's departure from the European Union commonly referred to as "Brexit." The potential effects of Brexit on our business will depend upon any agreements the United Kingdom makes to retain access to European Union markets either during the current transitional period or more permanently and negotiations are ongoing. Since we have operations in the United Kingdom and Europe, Brexit could potentially have corporate structural consequences, adversely change tax benefits or liabilities and disrupt some of the markets and jurisdictions in which we operate. In addition, Brexit could lead to legal uncertainty and potentially divergent national laws and regulations as the United Kingdom determines which European Union laws to replace or replicate.

We may face unexpected implementation challenges related to the complexity of our customers' implementation and integration requirements, particularly implementations for larger customers that have heightened levels of complexity in their hardware, software and network infrastructure needs. Additionally, as a result of the COVID-19 pandemic, nearly all of our employees, and many of the employees of our customers and third-party providers on which we depend, now perform their functions remotely. Our implementation expenses increase when customers have unexpected data, hardware or software technology challenges, or complex or unanticipated business or regulatory requirements. In addition, our customers typically require complex acceptance testing related to the implementation of our solutions. Implementation services will be more challenging when being performed by our employees remotely in conjunction with customers and third-party providers whose employees also may be working remotely. Implementation delays also may require us to delay revenue recognition under the related customer agreement longer than expected. Further, because we do not fully control our customers' implementation schedules, if our customers do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties, including operational or staffing challenges related to the COVID-19 pandemic, our revenue recognition may be delayed. Losses of End Users or any difficulties or delays in implementation processes could cause customers to delay or forgo future purchases of our solutions, which would adversely affect our business, operating results and financial condition.