Blackbaud Inc: Form 10-Q for the period ended Sep 30, 2023

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited, condensed consolidated financial statements and related notes included elsewhere in this Quarterly Report on Form 10-Q. The following discussion and analysis presents financial information denominated in millions of dollars which can lead to differences from rounding when compared to similar information contained in the unaudited, condensed consolidated financial statements and related notes which are primarily denominated in thousands of dollars.

Executive Summary

We are the leading software provider exclusively dedicated to powering social impact. Serving the nonprofit and education sectors, companies committed to social responsibility and individual change makers, our essential software is built to accelerate impact in fundraising, nonprofit financial management, digital giving, grantmaking, corporate social responsibility and education management. A remote-first company, we have operations in the United States, Australia, Canada, Costa Rica and the United Kingdom, supporting users in 100+ countries.

Our revenue is primarily generated from the following sources: (i) charging for the use of our software solutions in cloud and hosted environments; (ii) providing payment and transactional services; (iii) providing Impact-as-a-Service™ digital educational content; (iv) providing software maintenance and support services; and (v) providing professional services, including implementation, consulting, training, analytic and other services.

Update on Five Key Operational Initiatives

1. Product Innovation and Delivery

Product is core at Blackbaud, and we strive to bring increased value to our customers through their software subscriptions with improved and innovative capabilities. For example, we recently released a new, next generation donation form in Raiser’s Edge NXT with the goal of increasing the conversion rate and donations our customers raise. We match the new donation form with Prospect Insights, which utilizes artificial intelligence ("AI") to identify and qualify candidates for major gifts. We recently began an early adopter program for the new donation form with a small sample of customers across charity, education, and arts and cultural organizations. We expect to make this generally available in the first half of 2024.

As recently announced, we introduced Impact Edge™ to our corporate sector customers. This newly developed solution aggregates EVERFI’s educational impact data, with employee volunteering and giving data from YourCause. It provides a single view of a company’s social impact program and replaces labor intensive, manually produced reports into a standardized structure. With Impact Edge, leaders who manage social impact initiatives are able to track and analyze performance of their programs in real time. We plan to put this new solution into an early adopter program late this year, with a full roll out in the second half of 2024.

Third Quarter 2023 Form 10-Q 25

For years, we have been using AI-enabled capabilities in our analytics offerings. We are expanding our strategy into next-generation and generative AI technology that addresses specific challenges of our customers. We continued to build on our “Intelligence for Good” strategy that leverages the power of machine learning and Artificial Intelligence across our products. For example, we recently introduced the “Story Enhancer” in JustGiving®, our consumer giving platform. This Generative AI capability has resulted in more engagement among early adopters and is expected to have positive downstream impact on our transactional revenue.

2. Bookings Growth and Acceleration

We drove strong bookings performance in the first quarter, up significantly versus last year, led by our corporate sector (YourCause and EVERFI solutions) which more than doubled its bookings over the first quarter of 2022. We signed a number of notable large contracts during the second and third quarters. As previously disclosed, there can be volatility quarter-to-quarter on bookings.

3. Transactional Revenue Optimization and Expansion

Transactional revenue, which is about one-third of total revenue, has proven to be resilient so far in 2023 following the lower average donation sizes we experienced during the fourth quarter of 2022. Different rate increases on Blackbaud Merchant Services in the U.S. took effect in January and August 2023. Our Blackbaud Tuition Management and JustGiving platforms continue to perform well against plan. And as we look ahead, our teams are hard at work to drive innovation across our payments solutions that are a win-win for both our customers and Blackbaud. We have already introduced our two fee cover models, and we are also looking at ways to optimize our payments solutions to drive a better donor experience.

4. Modernized Approach to Pricing and Multi-Year Contracts

Last summer, we put in place an updated pricing policy primarily for our social sector customers that directly reflects the value we provide to them, is in-line with the broader market and reflects the inflationary pressures that all businesses are facing. In November 2022, we started notifying customers with a March 2023 contract renewal that we would be making important contract changes. First, we are offering 3-year contract renewal terms as our standard, replacing one-year renewal terms. This process was already being implemented outside of the pricing changes. Second, we are implementing a more significant rate increase on the 1-year renewal option versus the 3-year renewal option. And third, the 3-year renewal option includes annual rate increases. Our 3-year renewal options did not historically include annual rate increases.

These efforts are well on their way. We have already notified customers with March 2024 contract renewals of the new terms. Through October 2023, nearly 90% of our 2023 contracts eligible for renewal rate increases have already renewed. The close day-to-day management of renewals, the mix of 3-year and 1-year contracts, and the impact of pricing are progressing well, and we expect more impact from the compounding effect of these rate increases over time as we layer in future year contract renewals and annual rate increases. For example, over 50% of our planned 2023 revenue will renew in a little over 3 years and approximately 35% of that renewable base is expected to renew this year. These contracts are renewing every day and create revenue growth that we expect to accelerate with each successive quarter this year. We expect that to further impact 2024 and 2025 as we begin to see the full-year impact of the rate increases. Approximately 30% of the renewable base is up for renewal in 2024 and more than 20% in 2025. The adoption of 3-year renewals as a standard, with more customers opting for this option than we originally expected, are expected to have an added benefit of higher retention which provides greater revenue assurance and predictability. Looking even further ahead, the cycle starts fresh in 2026 as the 2023 signed contracts will begin to renew. We expect that this will be a sustainable and meaningful revenue growth stream for us.

5. Keen Attention to Cost Management

We closed four legacy data centers during 2022, and we plan to close more this year. We renegotiated key vendor contracts including Microsoft Azure and AWS and made the difficult decision to further reduce our staff in the first quarter. Because we have organized to achieve much better scale efficiencies, we have significantly reduced our headcount since the third quarter of 2022. Our goal is to run the business at about this headcount level for the foreseeable future, such that our revenue growth will better drive margin acceleration.

Financial Summary

Total revenue increased by $16.3 million and $27.1 million during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, driven largely by the following:

For additional information on the impact of foreign currency fluctuations on our financial results, see Foreign Currency Exchange Rates below on page 47.

Third Quarter 2023 Form 10-Q 27

We have a number of multi-year pricing initiatives underway, some to bring our pricing in line with the market while others are model changes that are expected to drive greater revenue for both us and our customers. As a result, we expect to see a continued acceleration in revenue growth during the fourth quarter of 2023 as we begin to see the full-year effect of some of these pricing initiatives.

We expect that the one-time services and other revenue will continue to significantly decrease during 2023 compared to 2022 driven by our continued migration to the cloud in our core business.

Income from operations increased by $29.1 million and $25.3 million during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, driven largely by the following:

28 Third Quarter 2023 Form 10-Q

(Unaudited)

• Net increase of $1.3 million during the nine months ended September 30, 2023 primarily related to higher third-party software costs due to the number of licenses needed and also price increases for the software being used, partially offset by a decrease in rent and utilities
• Net decreases of $1.1 million and $2.8 million, respectively, due to an increase in amortization of capitalized software and content development costs, partially offset by an increase in software and content development costs that were required to be capitalized under the internal-use software guidance

We are continuing to make critical investments in the business in areas such as digital marketing, innovation, cybersecurity, and our continued shift of cloud infrastructure to leading public cloud service providers. Our profitability during the first three quarters of 2023 reflects some of these incremental investments.

We continuously seek opportunities to optimize our portfolio of solutions to focus time and resources on innovation that will have the greatest impact for our customers and the markets we serve, and drive the highest return on investment. To that end, we will continue to simplify and rationalize our portfolio through product sunsets and divestitures of non-core businesses and technologies.

Gross dollar retention

Our recurring subscription contracts are typically for a term of three years at contract inception. We have been for several years successfully shifting our legacy customer base away from annual renewals and moving them onto multi-year renewal contracts.

A key factor to our overall success is the renewal and expansion of our existing subscription agreements with our customers. Management uses gross dollar retention in analyzing our success at delighting our customers with innovative and cloud solutions. Gross dollar retention is defined as contracted annual recurring revenue ("CARR") divided by beginning CARR with a measurement period of twelve months. For the twelve months ended September 30, 2023, our gross dollar retention was approximately 90%. This gross dollar retention rate is relatively consistent with our rate for the full year ended December 31, 2022. We are continually investing in innovation, which we believe will increase gross dollar retention over the long-term. Although some customer attrition is normal, our new contract pricing and renewal model (as described above on page 26) does not appear to have had a significant impact on customer attrition to date.

Balance sheet and cash flow

At September 30, 2023, our cash and cash equivalents were $31.1 million. Under 2020 Credit Facility, the carrying amount of our debt was $683.2 million and our net leverage ratio was 2.11 to 1.00.

During the nine months ended September 30, 2023, we generated $203.0 million in cash from operations, had a net decrease in borrowings of $118.2 million, and had aggregate cash outlays of $48.9 million for purchases of property and equipment and capitalized software and content development costs.

We currently expect to resume stock repurchases during the fourth quarter of 2023 under our existing stock repurchase program that authorizes us to purchase up to $250.0 million of our outstanding shares of common stock.

Third Quarter 2023 Form 10-Q 29

Security Incident update

As discussed in Note 8 to our unaudited, condensed consolidated financial statements in this report, total costs related to the Security Incident exceeded the limit of our insurance coverage in the first quarter of 2022. Accordingly, the Security Incident has negatively impacted, and we expect it to continue for the foreseeable future to negatively impact, our GAAP profitability and GAAP cash flow (see discussion regarding non-GAAP free cash flow and non-GAAP adjusted free cash flow on page 42). For the three and nine months ended September 30, 2023, we incurred net pre-tax expenses of $4.1 million and $48.6 million, respectively, related to the Security Incident, which included $4.1 million and $18.6 million, respectively, for ongoing legal fees and additional accruals for loss contingencies of $0.0 million and $30.0 million, respectively. During the nine months ended September 30, 2023, we had net cash outlays of $23.1 million related to the Security Incident, which included ongoing legal fees and the $3.0 million civil penalty paid during the first quarter of 2023 related to the SEC settlement (as discussed in Note 8). In line with our policy, legal fees are expensed as incurred. For full year 2023, we currently expect net pre-tax expense of approximately $20.0 million to $30.0 million and net cash outlays of approximately $25.0 million to $35.0 million for ongoing legal fees related to the Security Incident. Not included in these ranges are our previous settlements or current accruals for loss contingencies related to the matters discussed below. For full year 2024, we currently expect a significant decrease in net pre-tax expense related to the Security Incident for ongoing legal fees.

As of September 30, 2023, we have recorded approximately $50.0 million in aggregate liabilities for loss contingencies based primarily on negotiations with certain governmental agencies related to the Security Incident that we believed we could reasonably estimate in accordance with our loss contingency procedures described in Note 8. In connection with the settlement of the multi-state Attorneys General investigation (as discussed in Note 8 and Note 12), we expect to pay $49.5 million during the fourth quarter of 2023.

There are other Security Incident-related matters, including customer claims, customer constituent class actions and governmental investigations, for which we have not recorded a liability for a loss contingency as of September 30, 2023 because we are unable at this time to reasonably estimate the possible loss or range of loss. Each of these matters could, separately or in the aggregate, result in an adverse judgment, settlement, fine, penalty or other resolution, the amount, scope and timing of which we are currently unable to predict, but could have a material adverse impact on our results of operations, cash flows or financial condition.

Results of Operations

Comparison of the three and nine months ended September 30, 2023 and 2022

Revenue and Cost of Revenue

Recurring revenue is comprised of fees for the use of our subscription-based software solutions, which includes providing access to cloud solutions, Impact-as-a-Service™ digital educational content, hosting services, payment services, online training programs and subscription-based analytic services. Recurring revenue also includes fees from maintenance services for our on-premises solutions, services included in our renewable subscription contracts, retained and managed services contracts that we expect to have a term consistent with our cloud solution contracts, and variable transaction revenue associated with the use of our solutions.

Cost of recurring revenue is primarily comprised of compensation costs for customer support and production IT personnel, hosting and data center costs, third-party contractor expenses, third-party royalty and data expenses, allocated depreciation, facilities and IT support costs, amortization of intangible assets from business combinations, amortization of software development costs, transaction-based costs related to payments services including remittances of amounts due to third-parties and other costs incurred in providing support and recurring services to our customers.

Our customers continue to prefer cloud subscription offerings with integrated analytics, training and payment services. We intend to continue focusing on innovation, quality and integration of our cloud solutions, which we believe will drive future revenue growth.

Third Quarter 2023 Form 10-Q 31

Recurring revenue increased by $19.6 million, or 7.9%, and $37.6 million, or 5.0%, during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, driven primarily by the following:

For additional information on the impact of foreign currency fluctuations on our financial results, see Foreign Currency Exchange Rates below on page 47.

Cost of recurring revenue increased by $2.6 million, or 2.4%, and $4.4 million, or 1.3%, during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, driven primarily by the following:

Recurring gross margin increased by 230 and 160 basis points for the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, primarily due to the increases in recurring revenue outpacing the changes in cost of recurring revenue.

(Unaudited)

One-time services and other revenue is comprised of fees for one-time consulting (including creative services), analytic and onsite training services, fees for retained and managed services contracts that we do not expect to have a term consistent with our cloud solution contracts, revenue from the sale of our software sold under perpetual license arrangements, and third-party software referral fees.

Cost of one-time services and other is primarily comprised of compensation costs for professional services and onsite training personnel, other costs incurred in providing onsite customer training, third-party contractor expenses, data expense incurred to perform one-time analytic services, third-party software royalties, allocated depreciation, facilities and IT support costs and amortization of intangible assets from business combinations.

One-time services and other revenue decreased by $3.3 million, or 27.6%, and $10.5 million, or 28.6%, during the three and nine months ended September 30, 2023, when compared to the same periods in 2022, driven primarily by the following:

• Decreases in one-time consulting revenue of $2.1 million and $7.8 million, respectively, primarily due to less sales of creative services and implementation and customization services. Also contributing is an increase in utilization of third-party service delivery partners. For several years, we have been strategically shifting away from a one-time services business model towards sales of retained and managed services and also embedding services in our renewable cloud solution contracts. Retained and managed services contracts that we expect to have a term consistent with our cloud solution contracts, and embedded services are recorded as recurring revenue.
• Decreases in one-time analytics revenue of $1.2 million and $2.8 million, respectively, as analytics are generally integrated in our cloud solutions

Third Quarter 2023 Form 10-Q 33

Cost of one-time services and other decreased by $1.8 million, or 19.2%, and $8.0 million, or 25.1%, during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, driven primarily by the following:

• Decreases in compensation costs of $1.9 million and $6.9 million, respectively, primarily related to our targeted workforce reductions discussed above and a continued shift in resources historically supporting one-time services and other towards recurring revenue

One-time services and other gross margin decreased by 920 basis points and 420 basis points during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, primarily due to the decrease of one-time services and other revenue outpacing the decrease in compensation costs discussed above.

Operating Expenses

Sales, marketing and customer success

Sales, marketing and customer success expense includes compensation costs, variable sales commissions, travel-related expenses, advertising and marketing materials, public relations costs, variable reseller commissions and allocated depreciation, facilities and IT support costs.

We see a large market opportunity in the long-term and will continue to make investments to drive sales effectiveness. We have also implemented software tools to enhance our digital footprint and drive lead generation. The enhancements we are making in our go-to-market approach are expected to reduce our average customer acquisition cost per customer as well as the related payback period while increasing sales velocity.

Sales, marketing and customer success expense decreased by $4.0 million or 7.0%, and $4.3 million or 2.6%, during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, primarily driven by the following:

Research and development

Research and development expense includes compensation costs for engineering and product management personnel, third-party contractor expenses, software development tools and other expenses related to developing new solutions or upgrading and enhancing existing solutions that do not qualify for capitalization, and allocated depreciation, facilities and IT support costs.

We continue to make investments to delight our customers with innovative and secure cloud solutions. Research and development expenses decreased by $2.5 million, or 6.1%, and $4.0 million or 3.4%, during the three and nine months ended September 30, 2023, respectively, when compared to the same periods in 2022, primarily driven by the following:

Not included in research and development expense for the three months ended September 30, 2023 and 2022 were $15.7 million and $15.1 million, respectively, and for the nine months ended September 30, 2023 and 2022 were $45.4 million and $43.6 million, respectively, of qualifying costs associated with software and content development activities that are required to be capitalized under GAAP, such as those for our cloud solutions, as well as development costs associated with acquired companies. Qualifying capitalized development costs associated with our cloud solutions are subsequently amortized to cost of recurring revenue over the related assets' estimated useful life, which generally range from three to seven years.

General and administrative

General and administrative expense consists primarily of compensation costs for general corporate functions, including senior management, finance, accounting, legal, human resources and corporate development, Security Incident-related expenses (including legal fees, settlements and loss contingency accruals), third-party professional fees, insurance, allocated depreciation, facilities and IT support costs, acquisition-related expenses and other administrative expenses.

Third Quarter 2023 Form 10-Q 35

General and administrative expense decreased by $7.3 million or 14.6%, during the three months ended September 30, 2023, when compared to the same period in 2022, primarily driven by the following:

General and administrative expense increased by $13.6 million or 9.6%, during the nine months ended September 30, 2023, when compared to the same period in 2022, primarily driven by the following:

36 Third Quarter 2023 Form 10-Q

Interest Expense

Interest expense ($M)

Percentages indicate expenses as a percentage of total revenue

Interest expense in dollars and as a percentage of total revenue during the three months ended September 30, 2023, was relatively in line with the same period in 2022. The increase in interest expense in dollars and as a percentage of total revenue during the nine months ended September 30, 2023, respectively, when compared to the same period in 2022, was primarily due to an increase in our weighted average effective interest rates. We currently expect interest expense for the full year 2023 to be approximately $37 million to $41 million although our interest expense in connection with the variable rate portion of our outstanding debt could increase in a rising interest rate environment. See Note 7 to our unaudited, condensed consolidated financial statements in this report for more information regarding our derivative instruments, which we use to manage our variable interest rate risk, and Item 3. Quantitative and Qualitative Disclosures about Market Risk: Interest Rate Risk (below) for more information about our variable interest rate exposure and related risk.

Deferred Revenue

The table below compares the components of deferred revenue from our unaudited, consolidated balance sheets:

(dollars in millions)

(1) The individual amounts for each year may not sum to deferred revenue or current portion of deferred revenue due to rounding.

To the extent that our customers are billed for our solutions and services in advance of delivery, we record such amounts in deferred revenue. Our recurring revenue contracts are generally for a term of three years at contract inception, billed annually in advance, and non-cancelable. We have been for several years successfully shifting our legacy customer base away from annual renewals and moving them onto multi-year renewal contracts. We generally invoice our customers with recurring revenue contracts in annual cycles 30 days prior to the end of each one-year period.

The increase in deferred revenue during the nine months ended September 30, 2023 was primarily due to a seasonal increase in customer contract billings/renewals, which includes impact from our recent pricing initiatives. Historically, due to the timing of customer budget cycles, we have an increase in customer contract renewals at or near the beginning of our third quarter. Generally, our lowest balance of deferred revenue during the year is at the end of our first quarter.

Third Quarter 2023 Form 10-Q 37

Income Taxes

Income tax provision (benefit) ($M)

Percentages indicate effective income tax rates

The increases in our effective income tax rate for the three and nine months ended September 30, 2023, when compared to the same periods in 2022 were primarily attributable to unfavorable impact of non-deductible Security Incident accruals. See Note 8 to our unaudited, condensed consolidated financial statements in this report for additional information about our loss contingency accruals related to the Security Incident.

Non-GAAP Financial Measures

The operating results analyzed below are presented on a non-GAAP basis. We use non-GAAP financial measures internally in analyzing our operational performance. Accordingly, we believe these non-GAAP measures are useful to investors, as a supplement to GAAP measures, in evaluating our ongoing operational performance. While we believe these non-GAAP measures provide useful supplemental information, non-GAAP financial measures should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with GAAP. In addition, these non-GAAP financial measures may not be completely comparable to similarly titled measures of other companies due to potential differences in the exact method of calculation between companies.

The non-GAAP financial measures discussed below exclude the impact of certain transactions because we believe they are not directly related to our operating performance in any particular period, but are for our long-term benefit over multiple periods. We believe that these non-GAAP financial measures reflect our ongoing business in a manner that allows for meaningful period-to-period comparisons and analysis of trends in our business.

(Unaudited)

(dollars in millions, except per share amounts)

(1) The individual amounts for each year may not sum to subtotal, non-GAAP gross profit, non-GAAP income from operations, non-GAAP income before provision for income taxes or non-GAAP net income due to rounding.

(2) Includes a $2.0 million noncash impairment of certain intangible assets held for sale during the nine months ended September 30, 2022.

(3) Includes noncash impairment charges incurred during the three and nine months ended September 30, 2023 related to the sublease of our Washington, DC office location the lease of which was acquired during the EVERFI acquisition.

(4) Includes Security Incident-related costs incurred during the three and nine months ended September 30, 2023 of $4.1 million and $48.6 million, respectively, which includes approximately $0.0 million and $30.0 million, respectively, in recorded liabilities for loss contingencies, net of insurance recoveries during the same periods of $0.0 million, and during the three and nine months ended September 30, 2022 of $13.7 million and $31.1 million, respectively, net of insurance recoveries during the same periods that were $0.0 million and $1.9 million, respectively. Recorded expenses consisted primarily of payments to third-party service providers and consultants, including legal fees, as well as settlements of customer claims, negotiated settlements and accruals for certain loss contingencies. Not included in this adjustment were costs associated with enhancements to our cybersecurity program. For full year 2023, we currently expect net pre-tax expense of approximately $20 million to $30 million and net cash outlays of approximately $25 million to $35 million for ongoing legal fees related to the Security Incident. Not included in these ranges are our previous settlements or current accruals for loss contingencies related to the matters discussed below. For full year 2024, we currently expect a significant decrease in net pre-tax expense related to the Security Incident for ongoing legal fees. In line with our policy, legal fees are expensed as incurred. As of September 30, 2023, we have recorded approximately $50.0 million in aggregate liabilities for loss contingencies based primarily on recent negotiations with certain governmental agencies related to the Security Incident that we believe we can reasonably estimate. In connection with the settlement of the multi-state Attorneys General investigation (as discussed in Note 8 and Note 12), we expect to pay $49.5 million during the fourth quarter of 2023. There are other Security Incident-related matters, including customer claims, customer constituent class actions and governmental investigations, for which we have not

Third Quarter 2023 Form 10-Q 39 recorded a liability for a loss contingency as of September 30, 2023 because we are unable at this time to reasonably estimate the possible loss or range of loss. Each of these matters could, separately or in the aggregate, result in an adverse judgment, settlement, fine, penalty or other resolution, the amount, scope and timing of which we are currently unable to predict, but could have a material adverse impact on our results of operations, cash flows or financial condition.

(5) We apply a non-GAAP effective tax rate of 20.0% when calculating non-GAAP net income and non-GAAP diluted earnings per share.

Non-GAAP organic revenue growth

In addition, we use non-GAAP organic revenue growth, non-GAAP organic revenue growth on a constant currency basis, non-GAAP organic recurring revenue growth and non-GAAP organic recurring revenue growth on a constant currency basis in analyzing our operating performance. We believe that these non-GAAP measures are useful to investors, as a supplement to GAAP measures, for evaluating the periodic growth of our business on a consistent basis. Each of these measures of non-GAAP organic revenue growth excludes incremental acquisition-related revenue attributable to companies acquired in the current fiscal year. For companies, if any, acquired in the immediately preceding fiscal year, each of these non-GAAP organic revenue growth measures reflects presentation of full year incremental non-GAAP revenue derived from such companies as if they were combined throughout the prior period. In addition, each of these non-GAAP organic revenue growth measures excludes prior period revenue associated with divested businesses. The exclusion of the prior period revenue is to present the results of the divested businesses within the results of the combined company for the same period of time in both the prior and current periods. We believe this presentation provides a more comparable representation of our current business’ organic revenue growth and revenue run-rate.

(dollars in millions)

(1) Non-GAAP revenue from divested businesses excludes revenue associated with divested businesses. The exclusion of the prior period revenue is to present the results of the divested business with the results of the combined company for the same period of time in both the prior and current periods.

(2) Non-GAAP organic revenue and non-GAAP organic recurring revenue for the prior year periods presented herein may not agree to non-GAAP organic revenue and non-GAAP organic recurring revenue presented in the respective prior period quarterly financial information solely due to the manner in which non-GAAP organic revenue growth and non-GAAP organic recurring revenue growth are calculated.

(3) To determine non-GAAP organic revenue growth and non-GAAP organic recurring revenue growth on a constant currency basis, revenues from entities reporting in foreign currencies were translated to U.S. Dollars using the comparable prior period's quarterly weighted average foreign currency exchange rates. The primary foreign currencies creating the impact are the Australian Dollar, British Pound, Canadian Dollar and Euro.

Rule of 40

We previously defined Rule of 40 as non-GAAP organic revenue growth plus non-GAAP adjusted EBITDA margin. Non-GAAP adjusted EBITDA is defined as GAAP net income plus interest, net; income tax provision (benefit); depreciation; amortization of intangible assets from business combinations; amortization of software and content development costs; stock-based compensation; employee severance; acquisition and disposition-related costs; restructuring and other real estate activities; Security Incident-related costs, net of insurance; and impairment of capitalized software development costs. Beginning in the fiscal quarter ended June 30, 2022, we now also include in non-GAAP adjusted EBITDA impairment of capitalized software development costs because we believe it is not directly related to our operating performance in any particular period.

(dollars in millions)

(1) Includes amortization expense related to software development costs and amortization expense from capitalized cloud computing implementation costs.

(2) The individual amounts for each year may not sum to subtotal, non-GAAP EBITDA, non-GAAP adjusted EBITDA or non-GAAP adjusted EBITDA on a constant currency basis due to rounding.

(3) Measured by GAAP revenue divided by non-GAAP EBITDA.

(4) See additional details in the reconciliation of GAAP to Non-GAAP operating income above.

(5) Measured by non-GAAP organic revenue divided by non-GAAP adjusted EBITDA.

(6) Measured by non-GAAP organic revenue growth plus non-GAAP adjusted EBITDA margin. See Non-GAAP organic revenue growth table above.

(7) To determine non-GAAP adjusted EBITDA on a constant currency basis, non-GAAP adjusted EBITDA from entities reporting in foreign currencies were translated to U.S. Dollars using the comparable prior period's quarterly weighted average foreign currency exchange rates. The primary foreign currencies creating the impact are the Australian Dollar, British Pound, Canadian Dollar and Euro.

(8) Measured by non-GAAP organic revenue growth on constant currency basis plus non-GAAP adjusted EBITDA margin on constant currency basis. See Non-GAAP organic revenue growth table above.

Third Quarter 2023 Form 10-Q 41

Non-GAAP free cash flow and non-GAAP adjusted free cash flow

Non-GAAP free cash flow is defined as operating cash flow less capital expenditures, including costs required to be capitalized for software and content development, and capital expenditures for property and equipment.

Non-GAAP adjusted free cash flow is defined as operating cash flow less capital expenditures, including costs required to be capitalized for software and content development and capital expenditures for property and equipment, plus cash outflows, net of insurance, related to the Security Incident.

We believe non-GAAP free cash flow and non-GAAP adjusted free cash flow provides useful measures of the Company's operating performance. Non-GAAP adjusted free cash flow is not intended to represent and should not be viewed as the amount of residual cash flow available for discretionary expenditures.

(dollars in millions)

(1) The individual amounts for each year may not sum to non-GAAP free cash flow or non-GAAP adjusted free cash flow due to rounding.

Seasonality

Our revenues normally fluctuate as a result of certain seasonal variations in our business. Our first quarter has historically been the seasonal low for bookings, with the second and fourth quarters historically being seasonally higher, and our bookings tend to be back-end loaded within individual quarters given our quarterly quota plans. Transactional revenue is non-contractual and less predictable given the susceptibility to certain drivers such as timing and number of events and marketing campaigns, as well as fluctuations in donation volumes and tuition payments. Our transactional revenue has historically been at its lowest in the first quarter due to the timing of customer fundraising initiatives and events. We have historically experienced seasonal highs during the fourth quarter due to year-end giving campaigns and during the second quarter when a large number of events are held. Our revenue from professional services has historically been lower in the first quarter when many of those services commence and in the fourth quarter due to the holiday season. As a result of these and other factors, our total revenue has historically been lower in the first quarter than in the remainder of our fiscal year, with the fourth quarter historically achieving the highest total revenue. Our expenses, other than transaction-based costs related to our payments services, do not vary significantly as a result of these factors, but do fluctuate on a quarterly basis due to varying timing of expenditures.

Our cash flow from operations normally fluctuates quarterly due to the combination of the timing of customer contract renewals including renewals associated with customers of acquired companies, delivery of professional services and occurrence of customer events, as well as merit-based salary increases, among other factors. Historically, due to lower revenues in our first quarter, combined with the payment of certain annual vendor contracts, our cash flow from operations has been lowest in our first quarter. Due to the timing of customer contract renewals and student enrollments, many of which take place at or near the beginning of our third quarter, our cash flow from operations has generally been lower in our second quarter as compared to our third and fourth quarters. Partially, offsetting these favorable drivers of cash flow from operations in our third and fourth quarters are base salary merit increases, which occur in July. In addition, deferred revenues can vary on a seasonal basis due to the timing of customer contract renewals and student enrollments or significant acquisitions. Our cash flow from financing is negatively impacted in our first quarter when most of our equity awards vest, as we pay taxes on behalf of our employees related to the settlement or exercise of equity awards.

These patterns may change as a result of the continued shift to online giving, growth in volume of transactions for which we process payments, large dollar customer bookings and contract renewals, or as a result of acquisitions, new market opportunities, new solution introductions or other factors.

Liquidity and Capital Resources

The following table presents selected financial information about our financial position:

(dollars in millions)

The following table presents selected financial information about our cash flows:

(dollars in millions)

Our principal sources of liquidity are our operating cash flow, funds available under the 2020 Credit Facility and cash on hand. Our operating cash flow depends on continued customer renewal of our subscription and maintenance arrangements, market acceptance of our solutions and services, the volume and size of transactions for which we process payments and our customers' ability to pay. Based on current estimates of revenue and expenses, we believe that the currently available sources of funds and anticipated cash flows from operations will be adequate for at least the next twelve months to finance our operations, fund anticipated capital expenditures and meet our debt obligations. We also believe that we will be able to continue to meet our long-term cash requirements due to our anticipated cash flow from operations, solid financial position and ability to access capital from financial markets. To the extent we undertake future material acquisitions or investments or unanticipated capital or operating expenditures, including in connection with the Security Incident, we may require additional capital. In that context, we regularly evaluate opportunities to enhance our capital structure, including through potential debt or equity issuances. In the near term, excluding any future material events noted above or otherwise, we intend to reduce our net leverage, which was 2.11 to 1.00 at September 30, 2023, as defined by our credit agreement, to our target level of 2 to 1 or less. We also currently expect to resume stock repurchases during the fourth quarter of 2023.

As a well-known seasoned issuer, we filed an automatic shelf registration statement for an undetermined amount of debt and equity securities with the SEC on January 14, 2022. Under this universal shelf registration statement we may offer and sell, from time to time, debt securities, common stock, preferred stock, depositary shares, warrants, stock purchase contracts and stock purchase units. Subject to certain conditions, this registration statement will be effective through January 13, 2024.

At September 30, 2023, our total cash and cash equivalents balance included approximately $19.7 million of cash that was held by operations outside the U.S. While these funds may not be needed to fund our U.S. operations for at least the next twelve months, if we need these funds, we may be required to accrue and pay taxes to repatriate the funds. We currently do not intend nor anticipate a need to repatriate our cash held outside the U.S.

Third Quarter 2023 Form 10-Q 43

Operating Cash Flow

Our cash flows from operations are derived principally from: (i) our earnings from on-going operations prior to non-cash expenses such as depreciation, amortization, stock-based compensation, deferred taxes, amortization of deferred financing costs and debt discount and adjustments to our provision for credit losses and sales returns; and (ii) changes in our working capital.

Working capital changes are composed of changes in accounts receivable, prepaid expenses and other assets, trade accounts payable, accrued expenses and other liabilities, and deferred revenue.

Net cash provided by operating activities increased by $13.2 million during the nine months ended September 30, 2023, when compared to the same period in 2022, primarily due to a $27.5 million increase in net income adjusted for non-cash expenses and a $14.4 million decrease in cash flow from operations associated with working capital.

The decrease in cash flow from operations associated with working capital during the nine months ended September 30, 2023, when compared to the same period in 2022, was primarily due to:

• fluctuations in the timing of vendor payments; and
• a decrease in taxes payable; partially offset by
• an increase in accrued expenses, including accrued bonuses and the Security Incident.

Security Incident update

As discussed in Note 8 to our unaudited, condensed consolidated financial statements in this report, total costs related to the Security Incident exceeded the limit of our insurance coverage in the first quarter of 2022. Accordingly, the Security Incident has negatively impacted, and we expect it to continue for the foreseeable future to negatively impact, our GAAP profitability and GAAP cash flow (see discussion regarding non-GAAP free cash flow and non-GAAP adjusted free cash flow on page 42). For full year 2023, we currently expect net pre-tax expense of approximately $20 million to $30 million and net cash outlays of approximately $25 million to $35 million for ongoing legal fees related to the Security Incident. In line with our policy, legal fees are expensed as incurred. Not included in these ranges are our previous settlements or current accruals for loss contingencies related to the matters discussed below. For full year 2024, we currently expect a significant decrease in net pre-tax expense related to the Security Incident for ongoing legal fees.

As of September 30, 2023, we have recorded approximately $50.0 million in aggregate liabilities for loss contingencies based primarily on negotiations with certain governmental agencies related to the Security Incident that we believed we could reasonably estimate in accordance with our loss contingency procedures described in Note 8. In connection with the settlement of the multi-state Attorneys General investigation (as discussed in Note 8 and Note 12), we expect pay $49.5 million during the fourth quarter of 2023.

There are other Security Incident-related matters, including customer claims, customer constituent class actions and governmental investigations, for which we have not recorded a liability for a loss contingency as of September 30, 2023 because we are unable at this time to reasonably estimate the possible loss or range of loss. Each of these matters could, separately or in the aggregate, result in an adverse judgment, settlement, fine, penalty or other resolution, the amount, scope and timing of which we are currently unable to predict, but could have a material adverse impact on our results of operations, cash flows or financial condition.

Investing Cash Flow

Net cash used in investing activities of $49.2 million decreased by $18.6 million during the nine months ended September 30, 2023, when compared to the same period in 2022.

During the nine months ended September 2022, we received net cash of $6.4 million related to our disposition of Blackbaud FIMS™ and DonorCentral® NXT.

During the nine months ended September 30, 2022, we used $20.9 million of net cash for our acquisitions of EVERFI and Kilter, comprised primarily of (i) $17.4 million that had not been paid by EVERFI to its former option holders as of December 31, 2021, solely due to the timing of the acquisition on the last day of 2021; (ii) $2.9 million that was paid to acquire Kilter; and (iii) $2.6 million that was paid to a number of EVERFI's selling shareholders after determining they would be paid in cash, rather than shares of our common stock.

During the nine months ended September 30, 2023, we used $44.7 million for software and content development costs, which was up $1.9 million from cash spent during the same period in 2022. We also spent $4.2 million of cash for purchases of property and equipment during the nine months ended September 30, 2023, which was a decrease of $6.3 million when compared to the same period in 2022.

Financing Cash Flow

During the nine months ended September 30, 2023, we had a net decrease in borrowings of $118.2 million.

We paid $35.6 million to satisfy tax obligations of employees upon settlement of equity awards during the nine months ended September 30, 2023 compared to $36.1 million during the same period in 2022. The amount of taxes paid by us on behalf of employees related to the settlement of equity awards varies from period to period based upon the timing of grants and vesting, as well as the market price for shares of our common stock at the time of settlement. Most of our equity awards currently vest in our first quarter.

During the nine months ended September 30, 2023, cash flow from financing activities associated with changes in restricted cash due to customers decreased $339.7 million, compared to a decrease of $243.1 million during the same period in 2022. This line in the statement of cash flows represents the change in the amount of restricted cash held and payable by us to customers from one period to the next.

Stock repurchase program

In December 2021, our Board of Directors reauthorized and replenished our stock repurchase program that authorizes us to purchase up to $250.0 million of our outstanding shares of common stock. The program does not have an expiration date. Under the stock repurchase program, we are authorized to repurchase shares from time to time in accordance with applicable laws both on the open market, including under trading plans established pursuant to Rule 10b5-1 under the Securities Exchange Act of 1934, as amended, and in privately negotiated transactions. The timing and amount of repurchases depends on several factors, including market and business conditions, the trading price of our common stock and the nature of other investment opportunities. The repurchase program may be limited, suspended or discontinued at any time without prior notice. During the three and nine months ended September 30, 2023, we did not purchase any shares. The remaining amount available to purchase stock under the stock repurchase program was $250.0 million as of September 30, 2023. We currently expect to resume stock repurchases during the fourth quarter of 2023.

2020 Credit Facility

Historically, we have drawn on our credit facility from time to time to help us meet financial needs, primarily due to the seasonality of our cash flows from operations and financing for business acquisitions. At September 30, 2023, our available borrowing capacity under the 2020 Credit Facility was $425.7 million. The 2020 Credit Facility matures in October 2025.

At September 30, 2023, the carrying amount of our debt under the 2020 Credit Facility was $683.2 million. Our average daily borrowings during the three and nine months ended September 30, 2023 were $727.8 million and $785.5 million, respectively.

The following is a summary of the financial covenants under the 2020 Credit Facility:

(1) Under the terms of the 2020 Credit Facility, the Net Leverage Ratio requirement may be increased by up to 0.50 provided we satisfy certain requirements, including a permitted business acquisition, and provided that the maximum Net Leverage Ratio shall not exceed 4.25 to 1.00.

Third Quarter 2023 Form 10-Q 45

Under the 2020 Credit Facility, we also have restrictions on our ability to declare and pay dividends and our ability to repurchase shares of our common stock. In order to pay any cash dividends and/or repurchase shares of stock: (i) no default or event of default shall have occurred and be continuing under the 2020 Credit Facility, and (ii) our pro forma net leverage ratio, as set forth in the 2020 Credit Facility, must be 0.25 less than the net leverage ratio requirement at the time of dividend declaration or share repurchase. At September 30, 2023, we were in compliance with our debt covenants under the 2020 Credit Facility. See Note 6 to our unaudited, condensed consolidated financial statements in this report for additional information regarding the 2020 Credit Facility.

Commitments and Contingencies

(in millions)

(1) The individual amounts may not sum to the total due to rounding.

Debt

As of September 30, 2023, we had total remaining principal payments of $744.4 million. These payments represent principal payments only, under the following assumptions: (i) that the amounts outstanding under the 2020 Credit Facility, our real estate loans and our other debt at September 30, 2023 will remain outstanding until maturity, with minimum payments occurring as currently scheduled, and (ii) that there are no assumed future borrowings on the revolving credit loans under the 2020 Credit Facility for the purposes of determining minimum commitment amounts. See Note 6 to our unaudited, condensed consolidated financial statements in this report for more information.

Interest payments on debt

In addition to principal payments, as of September 30, 2023, we expect to pay interest expense over the life of our debt obligations of approximately $101.6 million. These payments represent our estimated future interest payments on debt using our debt balances and the related weighted average effective interest rates as of September 30, 2023, which includes the effect of interest rate swap agreements. The actual interest expense recognized in our unaudited, condensed consolidated statements of comprehensive income will depend on the amount of debt, the length of time the debt is outstanding and the interest rate, which could be different from our assumptions on our remaining principal payments described above.

Operating leases

As of September 30, 2023, we had remaining operating lease payments of $57.8 million. These payments have not been reduced by sublease income, incentive payments, reimbursement of leasehold improvements or the amount representing imputed interest of $9.2 million. Our operating leases are generally for corporate offices, subleased offices and certain equipment and furniture. Given our remote-first workforce strategy and real estate footprint optimization efforts, as discussed above, we do not anticipate entering any new, material operating leases for offices for the foreseeable future. See Note 8 to our unaudited, condensed consolidated financial statements in this report for more information.

Purchase obligations

As of September 30, 2023, we had remaining purchase obligations of $273.3 million. These purchase obligations are for third-party technology used in our solutions and for other services we purchase as part of our normal operations. In certain cases, these arrangements require a minimum annual purchase commitment by us. Our purchase obligations are not recorded as liabilities on our unaudited, condensed consolidated balance sheets as of September 30, 2023, as we had not received the related services. See Note 8 to our unaudited, condensed consolidated financial statements in this report for more information.

The total liability for uncertain tax positions as of September 30, 2023 was $3.4 million. Our accrued interest and penalties related to tax positions taken on our tax returns was insignificant as of September 30, 2023.

In connection with the settlement of the multi-state Attorneys General investigation relating to the Security Incident, as discussed in Note 12 to our unaudited, condensed consolidated financial statements in this report, we have agreed to implement and improve certain of our cybersecurity programs and tools through October 2030. The currently anticipated costs in connection with these efforts are expected to be expensed as incurred.

Contingent consideration

In connection with our acquisition of Kilter in August 2022, we may be required to pay up to a maximum of $3.0 million in additional cash consideration if, during the two-year period commencing January 1, 2023, Kilter meets certain application participation targets. As of September 30, 2023, a liability for the contingent consideration is recorded at its current estimated fair value of $1.4 million in other liabilities on our unaudited, condensed consolidated balance sheets.

Foreign Currency Exchange Rates

Approximately 15% of our total revenue for the nine months ended September 30, 2023 was generated from operations outside the U.S. We do not have significant operations in countries in which the economy is considered to be highly inflationary. Our consolidated financial statements are denominated in U.S. dollars and, accordingly, changes in the exchange rate between foreign currencies and the U.S. dollar will affect the translation of our subsidiaries’ financial results into U.S. dollars for purposes of reporting our consolidated financial results. The accumulated currency translation adjustment, recorded within accumulated other comprehensive income as a component of stockholders’ equity, was a loss of $14.5 million as of September 30, 2023 and a loss of $14.9 million as of December 31, 2022. We have entered into foreign currency forward contracts to hedge a portion of the foreign currency exposure that arises on translation of our investments denominated in British Pounds into U.S. dollars.

The vast majority of our contracts are entered into by our U.S. or U.K. entities. The contracts entered into by the U.S. entity are almost always denominated in U.S. dollars or Canadian dollars, and contracts entered into by our U.K., Australian and Irish subsidiaries are generally denominated in British Pounds, Australian dollars and Euros, respectively. Historically, as the U.S. dollar weakened, foreign currency translation resulted in an increase in our revenues and expenses denominated in non-U.S. currencies. Conversely, as the U.S. dollar strengthened, foreign currency translation resulted in a decrease in our revenue and expenses denominated in non-U.S. currencies. During the nine months ended September 30, 2023, foreign translation resulted in a decrease in our revenues and an immaterial increase in our expenses denominated in non-U.S. currencies. Though we have exposure to fluctuations in currency exchange rates, primarily those between the U.S. dollar and both the British Pound and Canadian dollar, the impact has generally not been material to our consolidated results of operations or financial position. For the nine months ended September 30, 2023, the fluctuation in foreign currency exchange rates reduced our total revenue by $1.7 million and increased our income from operations by an insignificant amount. We have entered into foreign currency forward contracts to hedge revenues denominated in the Canadian dollar against changes in the exchange rate with the U.S. dollar. We will continue monitoring such exposure and take action as appropriate. To determine the impacts on revenue (or income from operations) from fluctuations in currency exchange rates, current period revenues (or income from operations) from entities reporting in foreign currencies were translated into U.S. dollars using the comparable prior year period's weighted average foreign currency exchange rates. These impacts are non-GAAP financial information and are not in accordance with, or an alternative to, information prepared in accordance with GAAP.

Third Quarter 2023 Form 10-Q 47

Critical Accounting Policies and Estimates

There have been no significant changes in our critical accounting policies and estimates during the nine months ended September 30, 2023 as compared to those disclosed in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022.

Recently Issued Accounting Pronouncements

For a discussion of the impact that recently issued accounting pronouncements are expected to have on our financial position and results of operations when adopted in the future, see Note 2 to our unaudited, condensed consolidated financial statements in this report.

We have market rate sensitivity for interest rates and foreign currency exchange rates.

Interest Rate Risk

Our variable rate debt is our primary financial instrument with market risk exposure for changing interest rates. We manage our variable rate interest rate risk through a combination of short-term and long-term borrowings and the use of derivative instruments entered into for hedging purposes. Our interest rate exposure includes SOFR rates. Because the Financial Conduct Authority in the U.K. previously stated that it would phase out all tenors of LIBOR by June 2023, we modified our financial contracts that were indexed to LIBOR to reference SOFR during 2022. These modifications did not have a significant financial impact. Due to the nature of our debt, the materiality of the fair values of the derivative instruments and the highly liquid, short-term nature and level of our cash and cash equivalents as of September 30, 2023, we believe that the risk of exposure to changing interest rates for those positions is immaterial. There were no significant changes in how we manage interest rate risk between December 31, 2022 and September 30, 2023.

Foreign Currency Risk

For a discussion of our exposure to foreign currency exchange rate fluctuations, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Foreign Currency Exchange Rates” in this report.

Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures (as defined in Securities Exchange Act Rule 13a-15(e) and 15d-15(e)) are designed only to provide reasonable assurance that they will meet their objectives. As of the end of the period covered by this report, we carried out an evaluation, under the supervision and with the participation of our management, including our Chief Executive Officer (principal executive officer) and Chief Financial Officer (principal financial and accounting officer), of the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) and 15d-15(e)) pursuant to Securities Exchange Act Rule 13a-15(b). Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures are effective to provide the reasonable assurance discussed above.

Changes in Internal Control Over Financial Reporting

No changes in internal control over financial reporting occurred during the most recent fiscal quarter ended September 30, 2023 with respect to our operations, which have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Third Quarter 2023 Form 10-Q 49

We are supplementing Item 1A. Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2022, as filed with the Securities and Exchange Commission on February 24, 2023 (the “Annual Report”). The following risk factors should be read in conjunction with the risk factors set forth in that Annual Report.

Strategic Risks

We are incorporating generative artificial intelligence, or AI, into certain of our products and services. This technology is new and developing, and while we aim to adopt known best practices, it may result in operational, financial and reputational harm and other adverse consequences to our business.

We are implementing AI features in certain of our products and services. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. Many U.S. and international governmental bodies and regulators have proposed, or are in the process of developing, new regulations related to the use of AI and machine learning technologies. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. We also expect that many of our generative AI features will include the processing of personal data and may be subject to laws, policies, legal obligations and codes of conduct related to privacy and data protection. There is uncertainty about the extent to which privacy and data protection laws apply to AI technologies, and any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as harm to our sales and reputation. In addition, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws or regulations. Accordingly, the implementation of generative AI technologies into our products and services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Furthermore, many of our AI features may rely on third-party service providers. As such, any improper processing of personal data by these service providers could harm our reputation, business or customers, or expose us to legal liability. Any disruption or failure in our AI systems or infrastructure could result in delays or errors in our operations, which could harm our business and financial results.

Our generative AI features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed, which may harm our reputation, business or customers, or expose us to legal liability. Also, some AI scenarios present ethical issues. If we enable or offer AI solutions that are controversial because of their purported or actual impact on human rights, privacy, employment or other social issues, we may experience reputational harm.

New and emerging AI technologies may require additional investment in the development and maintenance of various models, approaches and processes, as well as development of protections and safeguards for the use of AI technologies, which may be expensive and could impact our financial results if we decide to further expand generative AI into our products and services. Likewise, the use of AI involves significant technical complexity and requires specialized expertise. The success of any enhancement or new product depends on many factors, including its relevance to our customers, timely implementation and market acceptance. If our enhanced products and services do not achieve widespread market adoption or there is a reduction in demand due to a lack of customer acceptance, technology challenges, strengthening competition, weakening economic conditions, or security or privacy concerns, our business could be harmed and our financial results could be adversely affected.

Although we aim to develop and use AI responsibly and attempt to identify and mitigate ethical and legal issues presented by its use, we may be unsuccessful in identifying or resolving issues before they arise.

Operational Risks

The Security Incident has had, and may continue to have, numerous adverse effects on our business, results of operations, financial condition and cash flows.

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment that affected over 13,000 customers. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. However, our investigation into the Security Incident remains ongoing and may provide additional information.

To date, we have received approximately 260 customer reimbursement requests and approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court. Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident. In addition, presently, we are a defendant in putative consumer class action cases in U.S. federal courts (most of which have been consolidated under multi district litigation to a single federal court) and in Canadian courts alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. We have received a Civil Investigative Demand from the office of the California Attorney General relating to the Security Incident. In addition, we are subject to pending governmental actions or investigations by the U.S. Federal Trade Commission, the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada.

On October 5, 2023, the Company reached a settlement with each of 49 state Attorneys General and the District of Columbia in connection with the Security Incident. This settlement fully resolves the previously disclosed multi-state Civil Investigative Demand and the separate Civil Investigative Demand from the Office of the Indiana Attorney General relating to the Security Incident, which is further described in the substantially similar Administrative Orders filed in each of the 49 states and the District of Columbia.

Under the terms of the Administrative Orders, we have agreed: (i) to comply with state consumer protection laws, data breach notification laws, and HIPAA; (ii) not to make misleading misrepresentations to our customers or the individuals whose data is stored by us concerning (a) the extent to which we protect the privacy, security, confidentiality, or integrity of certain data, (b) the likelihood that data impacted by a security incident may be subject to unauthorized access, disclosure, or other misuse, or (c) the data breach notification requirements; and (iii) to implement and improve certain cybersecurity programs and tools.

As part of the Administrative Orders, we also agreed to pay a total of $49.5 million to the 49 states and District of Columbia. We expect to pay the full settlement amount to each state and the District of Columbia during the fourth quarter of 2023 from our existing liquidity. This amount was fully accrued as a contingent liability in our financial statements as of June 30, 2023. We entered into the Administrative Orders without admitting fault of liability in connection with the matters subject to the Multistate Investigation. The form of Administrative Order was furnished as Exhibit 99.2 to the Company’s Current Report on Form 8-K filed with the SEC on October 5, 2023.

Third Quarter 2023 Form 10-Q 51

On March 9, 2023, the Company reached a settlement with the SEC in connection with the Security Incident. This settlement fully resolves the previously disclosed SEC investigation of the Security Incident and is further described in the SEC Order. Under the terms of the SEC Order, the Company agreed to cease-and-desist from committing or causing any violations or any future violations of Sections 17(a)(2) and (3) of the Securities Act and Section 13(a) of the Exchange Act, and Rules 12b-20, 13a-13 and 13a-15(a) thereunder. As part of the SEC Order, the Company also agreed to pay, and has paid, a civil penalty in the amount of $3.0 million.

See Note 8 to our unaudited, condensed consolidated financial statements in this report for a more detailed description of the Security Incident and related matters.

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially in excess of the amounts accrued. Certain governmental authorities are seeking to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs.

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, for the three and nine months ended September 30, 2023, we incurred net pre-tax expenses of $4.1 million and $48.6 million, respectively, related to the Security Incident, which included $4.1 million and $18.6 million, respectively, for ongoing legal fees and additional accruals for loss contingencies of $0.0 million and $30.0 million, respectively. During the nine months ended September 30, 2023, we had net cash outlays of $23.1 million related to the Security Incident, which included ongoing legal fees and the $3.0 million civil penalty paid during the first quarter of 2023 related to the SEC settlement (as discussed in Note 8). For full year 2023, we currently expect net pre-tax expense of approximately $20.0 million to $30.0 million and net cash outlays of approximately $25.0 million to $35.0 million for ongoing legal fees related to the Security Incident. Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 8 to our unaudited, condensed consolidated financial statements in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2020 Credit Facility, we may be forced to renegotiate or obtain a waiver under the 2020 Credit Facility and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material.

Legal and Compliance Risks

Provisions in our organizational documents, our Stockholder Rights Agreement (as described below, the "Rights Agreement"), certain officer compensation arrangements and Delaware law may delay or prevent an acquisition or change of control of our Company that could be deemed beneficial to our stockholders.

Certain provisions in our organizational documents, the Rights Agreement, compensation arrangements with our officers and Delaware law (as summarized below) may have the effect of delaying, deferring, discouraging or preventing an acquisition or change in control of the Company or a change in our management. This includes tender offers for our common stock, proxy contests or other takeover attempts. These anti-takeover effects may discourage transactions that might result in the payment of a premium over the market price for shares of our common stock. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future.

Certificate of Incorporation and Bylaw provisions. The Board of Directors is divided into three classes of directors, as nearly equal in number as possible, with each class serving a staggered term of three years. The classification of directors will have the effect of making it more difficult and time-consuming for stockholders to change the composition of the Board of Directors, could discourage a third-party from making a tender offer or otherwise attempting to obtain control of the Company and may maintain the incumbency of the Board of Directors.

Our Bylaws contain an advance notice procedure for stockholders proposals to be brought before a meeting of stockholders, including any proposed nominations of persons for election to the Board of Directors. The Bylaws may have the effect of precluding the conduct of business at a meeting if the proper procedures are not followed and may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect its own slate of directors or otherwise attempting to obtain control of the Company.

The Board of Directors has the authority to issue up to an aggregate of 20,000,000 shares of preferred stock in one or more classes or series and to determine, with respect to any such class or series, the designations, powers, preferences and rights of such class or series, and the qualifications, limitations and restrictions thereof, including dividend rights, dividend rates, conversion rights, voting rights, terms of redemption (including sinking fund provisions), redemption prices, liquidation preferences, and the number of shares constituting any class or series or the designation of such class or series, without further vote or action by the stockholders. This preferred stock, including the Series A Preferred Stock described below, could have terms that may discourage a potential acquirer from making, without first negotiating with the Board of Directors, an acquisition attempt through which such acquirer may be able to change the composition of the Board of Directors, including a tender offer or other takeover attempt.

The Board of Directors possesses the authority to call and hold emergency special meetings of the Board of Directors with less than forty-eight hours’ notice. This power to hold an emergency special meeting of the Board of Directors on short notice could discourage a potential acquirer from launching a bid to acquire majority ownership of the Company, a proxy solicitation in order to replace the current Board of Directors, or otherwise attempting to obtain control of the Company.

Stockholder Rights Agreement. On October 7, 2022, the Company declared a dividend of one preferred share purchase right for each of the Company’s issued and outstanding shares of Common Stock. The description and terms of these Rights are set forth in the Rights Agreement by and between the Company and American Stock Transfer & Trust Company, LLC. Each Right entitles the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of the Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Series A Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”). Under the Rights Agreement, the Rights will become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of the outstanding Common Stock in a transaction not approved by the Board of Directors. In the event that the Rights become exercisable due to the ownership threshold being crossed, each Right will entitle its holder (other than the person, entity or group triggering the Rights Plan, whose rights will become void and will not be exercisable) to purchase additional shares of Common Stock having a then-current market value of twice the Exercise Price, which would likely make any takeover or change of control attempt by such entity, person or group prohibitively expensive. Subject to the terms of the Rights Agreement, the Rights were scheduled to expire on October 2, 2023. On October 2, 2023, the Company amended the Rights Agreement to extend the final expiration date from October 2, 2023 to October 2, 2024. The Company expects to submit the Amendment to the Company’s stockholders for ratification at the Company’s 2024 annual meeting of stockholders. Additional

Third Quarter 2023 Form 10-Q 53 information regarding the Amendment, including a copy of the Amendment, is contained in the Company’s Current Report on Form 8-K filed with the SEC on October 2, 2023.

Officer Compensation Arrangements. We have entered into an employment agreement with our Chief Executive Officer and retention agreements with certain of our officers, which provide that, upon the occurrence of a change in control of us and either the termination of their employment without cause (as defined) or their resignation for good reason (as defined), such persons would be entitled to certain termination or severance payments made by us (which may include a lump sum payment equal to defined percentages of compensation and accelerated vesting of certain equity stock awards paid in accordance with the terms and conditions of the respective agreement). Such provisions could significantly increase the costs to a third-party acquirer and/or deter such third-party from acquiring us.

Delaware anti-takeover law. We are subject to Section 203 of the Delaware General Corporation Law, an anti-takeover law. In general, Section 203 prohibits a publicly held Delaware corporation, such as the Company, from engaging in a “business combination” with an “interested stockholder” for a period of three years following the date the person became an interested stockholder, unless certain criteria are met. Generally, a “business combination” includes a merger, asset or stock sale, or other transaction resulting in a financial benefit to the interested stockholder. Generally, an “interested stockholder” is a person who, together with affiliates and associates, owns, or is an affiliate or associate of the corporation, and within three years prior to the determination of interested stockholder status did own, 15% or more of a corporation’s voting stock.