Veeva Systems (VEEV) Risk Factors

Nearly all of our sales are to customers in the life sciences industry. Demand for our solutions could be affected by factors that affect the life sciences industry, including: - The changing regulatory environment of the life sciences industry-Changes in regulations could negatively impact the business environment for our life sciences customers and for us. Healthcare laws and regulations are rapidly evolving and may change significantly in the future. For example, regulatory changes with respect to life sciences advertising, such as limitations on or the elimination of the ability of pharmaceutical companies to engage in direct-to-consumer advertising, could negatively impact certain of our product offerings, including our Crossix business. Further, legislation or regulatory changes regarding the pricing of drugs and other healthcare treatments sold by life sciences companies, including the extent to which the U.S. government or other governments may establish or negotiate prescription drug prices, has continued to be a topic of discussion by political leaders and regulators in the United States and elsewhere. Significant changes in drug pricing policy or regulation could result in life sciences companies reducing the number of sales representatives that use our products or otherwise reduce demand for our products. For example, the Inflation Reduction Act contains a number of significant drug pricing reforms, including provisions designed to limit the prices paid by Medicare for various prescription drugs. It is unclear at this time what impact this legislation will have on our business or our customers' businesses. We will continue to evaluate its impact. - Consolidation of companies within the life sciences industry-Consolidation within the life sciences industry has accelerated in recent years, and this trend could continue. We have in the past, and may in the future, suffer reductions in user subscriptions or non-renewal of customer subscription orders due to industry consolidation. We may not be able to expand sales of our solutions and services to new customers enough to counteract any negative impact of company consolidation on our business. In addition, new companies that result from such consolidation may decide that our solutions are no longer needed because of their own internal processes or alternative solutions. As these companies consolidate, competition to provide solutions and services will become more intense and establishing relationships with large industry participants will become more important. These industry participants may also try to use their market power to negotiate price reductions for our solutions. If consolidation of our larger customers occurs, the combined company may represent a larger percentage of business for us and, as a result, we are likely to rely more significantly on revenue from the combined company to continue to achieve growth. In addition, if large life sciences companies merge, it would have the potential to reduce per-unit pricing for our solutions for the merged companies or to reduce demand for one or more of our solutions as a result of potential personnel reductions over time. - Changes in the funding environment and bankruptcies in the life sciences industry-Our business depends on the overall economic health of our existing and prospective customers. The purchase of our solutions may involve a significant commitment of capital and other resources. Since 2022, there has been a reduction in funding for early-stage life sciences companies, which has resulted in reduced sales and adversely affected our financial results and may continue for the foreseeable future. Moreover, life sciences companies, and in particular early-stage companies with pre-commercial treatments in clinical trials, may ultimately be unsuccessful and may subsequently declare bankruptcy. If our customers declare bankruptcy or otherwise dissolve, they may terminate their agreements with us or we may not be able to recoup the full payment of fees owed to us. Certain of our customers or potential customers may also be negatively impacted by high interest rates and may find access to debt and other financing more difficult as a result. - Changes in market conditions and practices within the life sciences industry-The expiration of key patents, the implications of precision medicine treatments, changes in the practices of prescribing physicians and patients, changes with respect to payer relationships, and the policies and preferences of healthcare professionals and healthcare organizations with respect to the sales and marketing efforts of life sciences companies. Changes in public perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions. - Changes in geopolitical conditions that impact the life sciences industry, changes in the ability to sell healthcare treatments in certain locations, and the global availability of healthcare treatments provided by the life sciences companies to which we sell-If economic or geopolitical conditions deteriorates, or the ability to market life sciences products or conduct clinical trials in key markets is disrupted, including as a result of the Russian invasion of Ukraine, the Israel-Hamas conflict or resulting sanctions, or if the demand for life sciences products globally deteriorates for other reasons, our customers may delay or reduce their IT spending, particularly within the regions impacted by negative economic or geopolitical conditions. For example, a number of significant life sciences companies have scaled back sales, operations, and investments in Russia, including curtailing sales and marketing and clinical trial activity in Russia. Any of the above could result in reductions in sales of our solutions, longer sales cycles, reductions in subscription duration and value, slower adoption of new product offerings, and increased price competition. Accordingly, our operating results and our ability to efficiently provide our solutions to life sciences companies and to grow or maintain our customer base could be adversely affected as a result of these factors and others that affect the life sciences industry generally.

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, on December 1, 2022, we announced our intent to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform, and we do not intend to renew our agreement with Salesforce, Inc. when the current term expires on September 1, 2025. Pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers. Salesforce, Inc. also has the right to terminate the agreement early in certain circumstances, including in the event of a material breach of the agreement by us, or if Salesforce, Inc. is subjected to third-party intellectual property infringement claims based on our solutions (except to the extent based on the Salesforce platform) or our trademarks and we do not remedy such infringement in accordance with the agreement. Also, if we are acquired by specified companies, Salesforce, Inc. may terminate the agreement upon notice of not less than 12 months. On May 1, 2023, as allowed by the terms of our agreement, Salesforce Inc. terminated certain competition restrictions imposed by the agreement. Per the terms of the agreement, termination of those non-competition obligations by Salesforce, Inc. released us from our minimum order commitments in the future. Under the terms of our current agreement, Salesforce, Inc. is no longer prohibited from promoting third parties' products that are competitive to Veeva CRM, treating another third party as a "preferred" vendor of a CRM solution in the pharma and biotech market, or developing or promoting a product that competes with Veeva CRM. For example, Salesforce, Inc. and IQVIA announced an expanded CRM partnership under which IQVIA will license their CRM software to Salesforce and both parties will jointly market a new life sciences industry-specific CRM solution, which will compete with our offerings. In addition, current or potential customers may choose a competitor, such as Salesforce or IQVIA, or build their own custom solutions on the Salesforce platform rather than buy from us. Any of these events may have a material adverse impact on our business, operating results, and financial condition.

To execute our growth plan, we must attract and retain highly skilled employees. Competition for such employees and potential employees is intense. We have experienced, and expect to continue to experience, difficulty in hiring and retaining employees with the appropriate level of qualifications, and we also have experienced, and expect to continue to experience, intense recruitment of our employees by competitors and other technology companies. Further, it takes time for newly hired employees to become productive. With respect to sales professionals, for instance, even if we are successful in attracting highly qualified personnel, it may take six to nine months or longer before they are fully trained and productive. Many of the companies with which we compete for experienced employees have greater resources than we have and may offer compensation packages and benefits that are perceived to be better than ours. For example, we offer equity awards to a substantial majority of our job candidates and existing employees as part of their overall compensation package. If the perceived value of our equity awards declines, including as a result of prolonged declines in the market price of our common stock or changes in perception about our future prospects, it may adversely affect our ability to recruit and retain highly skilled employees. Additionally, changes in our compensation structure may be negatively received by employees and result in attrition or cause difficulty in the recruiting process. If we fail to attract new employees or fail to retain and motivate our current employees, our business and future growth prospects could be adversely affected. Additionally, we have adopted a "Work Anywhere" policy, which generally gives employees the flexibility to work in an office or at home on any given day, with certain job-specific restrictions. While we believe this program is beneficial to our business, over the long term we may find it challenging or more costly to maintain employee productivity and collaboration as we continue to grow our business. If we fail to maintain employee productivity and collaboration, our ability to attract and retain highly qualified employees and to achieve our business objectives could be negatively affected.

In addition to our employment of the Salesforce platform through our agreement with Salesforce, Inc., our solutions incorporate or use certain third-party software and software components obtained under licenses from other companies. We also use third-party software and tools in the development process for our solutions to manage and monitor our computing infrastructure, and to provide professional services and support our customers. For example, our Veeva CRM Engage Meeting application uses a purpose-built partner tool from Zoom Video Communications, Inc., which is critical to the application's functionality. We anticipate that we will continue to rely on such third-party software and development tools in the future. Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace. In addition, although we maintain a supplier security evaluation process, if the third-party software we use has errors, security vulnerabilities, or otherwise malfunctions, the functionality of our solutions may be negatively impacted, our customers may experience reduced service levels, and our business may suffer.

We derive a significant portion of our revenue from professional services fees. Our professional services revenues fluctuate from quarter to quarter as a result of the requirements, complexity, and timing of our customers' implementation projects. Generally, a customer's ongoing need for professional services decreases as the implementation and full deployment of our solutions is completed. Our customers may also choose to use third parties rather than us for certain professional services related to our solutions. As a result of these and other factors, our professional services revenues may not increase on a quarterly basis in the future or at all. Additionally, the gross margin generated from professional services fees fluctuates based on a number of factors which may vary from period to period, including the average billable hours worked by our billable professional services personnel, our average hourly rates for professional services, and the margin on professional services subcontracted to our third-party systems integrator partners. As a result of these and other factors, the gross margin from our professional services may not increase on a quarterly basis in the future or at all.

Our success and ability to compete depend in part upon our intellectual property. As of October 31, 2024, we have filed numerous domestic and foreign patent applications and have been issued 82 U.S. patents and 13 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies. In addition, in order to protect our intellectual property rights, we may also be required to spend significant resources to maintain, monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property (for example, if an entity against which we have asserted an intellectual property claim is successful in attacking the validity of our intellectual property). Negative publicity related to a decision by us to initiate such enforcement actions against a customer or former customer, regardless of its accuracy, may adversely impact our other customer relationships or prospective customer relationships, harm our brand and business and could cause the market price of our common stock to decline. Our failure to secure, protect and enforce our intellectual property rights could adversely affect our brand and our business.

Our solutions include software covered by open-source licenses. The terms of various open-source licenses have not been interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our solutions. It is possible under the terms of certain open-source licenses, if we combine our proprietary software with open-source software in a certain manner, that we could be required to release the source code of our proprietary software and make our proprietary software available under open-source licenses. In the event that portions of our proprietary software are determined to be subject to an open-source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our solutions, or otherwise be limited in the licensing of our solutions, each of which could reduce or eliminate the value of our solutions. In addition to risks related to license requirements, use of open-source software can lead to greater risks than use of third-party commercial software, as open-source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with the use of open-source software cannot be eliminated and could adversely affect our business.

We are subject to income taxes in the United States and various foreign jurisdictions. Our domestic and international tax liabilities are subject to the allocation of expenses in differing jurisdictions and complex transfer pricing regulations administered by taxing authorities in these jurisdictions. Tax rates may change as a result of factors outside of our control or relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, changes in tax and trade laws, treaties or regulations, or their interpretation or enforcement, have become more unpredictable and may become more stringent, which could have a material adverse effect on our tax position. Additionally, volatility in our stock price would affect the excess tax benefits from our equity compensation, which may adversely impact our effective tax rate. Forecasting our estimated annual effective tax rate is complex and subject to uncertainty, and there may be material differences between our forecasted and actual tax rates. Moreover, increases in our effective tax rate would reduce our profitability. Our tax provision could also be impacted by changes in accounting principles and changes in U.S. federal and state or international tax laws applicable to multinational corporations. For example, the Tax Cuts and Jobs Act of 2017 eliminated the option to deduct research and development expenditures currently and required taxpayers to capitalize and amortize them over five or fifteen years, which has negatively impacted our cash from operations. We made significant judgments and assumptions in the interpretation of this new law and in our calculations reflected in our financial results. Any changes in taxing jurisdictions' administrative interpretations, decisions, policies, and positions could also impact our tax liabilities. The overall tax environment has made it increasingly challenging for multinational corporations to operate with certainty about taxation in many jurisdictions. For example, the Organisation for Economic Co-operation and Development (OECD) is making progress with ongoing reforms of the international tax system, including changes to the practice of shifting profits among affiliated entities located in different tax jurisdictions. In October 2021, the OECD announced that more than 135 jurisdictions agreed on a two-pillar solution to address the tax challenges arising from the digitalization of the economy, including a global minimum effective corporate tax rate of 15% for certain large multinational companies, referred to as Pillar Two. A number of countries, including the United Kingdom, have implemented the legislation effective January 1, 2024, and we expect others to follow. We continue to monitor and assess the developments and implications surrounding changes in the global tax environment, including Pillar Two. The increasingly complex global tax environment could have a material adverse effect on our effective tax rate, results of operations, cash flows, and financial condition. Finally, we have been, and may be in the future, subject to income tax audits throughout the world. We believe our income, employment, and transactional tax liabilities are reasonably estimated and accounted for in accordance with applicable laws and principles, but an adverse resolution of one or more uncertain tax positions in any period could have a material impact on the results of operations for that period.

Our customers use our solutions to collect, use, store, disclose, and otherwise process personal data regarding their employees, healthcare professionals, and patients. Patient data may include sensitive health data. In many countries, governmental bodies have adopted or may adopt laws and regulations regarding the security, collection, use, storage, disclosure, and other processing of personal data, making compliance an increasingly complex task. Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom's General Data Protection Regulation (UK GDPR), we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, UK and Swiss Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and there may be significant penalties imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S. Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen and other customers may choose other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. In the United States, the U.S. Department of Health and Human Services promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws. U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information and create new privacy rights for individuals. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a "service provider" for our software solutions and a "business" for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix's data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply. In addition to government regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results. Customers expect that our solutions can be used in compliance with applicable data protection, data privacy and cybersecurity laws and regulations. Compliance with these global laws and regulations, including any new or evolving regulations relating to the use of data in artificial intelligence and machine learning technologies, such as the EU AI Act, has and will continue to require valuable management and employee time and resources and modification of our products or operations, and may also limit use and adoption of our products. Data protection authorities from around the world will from time to time review our products and services and their compliance with applicable laws and regulations. Any actual or perceived failure to comply with such laws and regulations or other actual or asserted obligations relating to privacy, data protection, or cybersecurity could lead to inspections, audits, regulatory investigations and other proceedings, significant fines, penalties, and other relief imposed by government agencies and regulatory bodies, and claims, demands, and litigation by our customers or third parties, which may reduce demand for our solutions and result in reputational harm, substantial damages and other liabilities.