CONDUENT Inc: Form 10-Q for the period ended Jun 30, 2025

(a) Sales of Unregistered Securities during the Quarter ended June 30, 2025

During the quarter ended June 30, 2025, the Company did not issue any securities in transactions that were not registered under the Securities Act of 1933, as amended.

(b) Purchases of Equity Securities by the Issuer and Affiliated Purchasers

Share repurchase activity during the three months ended June 30, 2025 was as follows:

(1) On May 20, 2025, the Board of Directors authorized a three-year share repurchase program, granting approval for the Company to repurchase up to $50 million of its common stock from time to time as market and business conditions warrant, including through open market purchases or Rule 10b5-1 trading plans.

(2) Average share price includes transaction commissions.

We are exposed to market risk from foreign currency exchange rates which could affect operating results, financial position and cash flows. We manage our exposure to this market risk through our regular operating and financing activities and, when appropriate, using derivative financial instruments. We utilized derivative financial instruments to hedge economic exposures, as well as reduce earnings and cash flow volatility resulting from shifts in market rates. We also hedge the cost to fund material non-dollar entities by buying currencies periodically in advance of the funding date. This is accounted for using derivative accounting.

Recent market events have not caused us to materially modify or change our financial risk management strategies with respect to our exposures to foreign currency risk. Refer to Note 8 – Financial Instruments in the Condensed Consolidated Financial Statements for additional discussion on our financial risk management.

During the reporting period, there have been no material changes to the quantitative and qualitative disclosures regarding our market risk set forth in our Annual Report on Form 10-K for the year ended December 31, 2024.

(a) Evaluation of Disclosure Controls and Procedures

The Company’s management evaluated, with the participation of our principal executive officer and principal financial officer, or persons performing similar functions, the effectiveness of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of the end of the period covered by this Form 10-Q. Based on this evaluation, our principal executive officer and principal financial officer have concluded that, as of the end of the period covered by this Form 10-Q, our disclosure controls and procedures were effective to ensure that information we are required to disclose in the reports that we file or submit under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms relating to the Company, including our consolidated subsidiaries, and was accumulated and communicated to the Company’s management, including the principal executive officer and principal financial officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

(b) Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting that occurred during the quarter ended June 30, 2025, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Reference is made to the Risk Factors set forth in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2024. There have been no material changes to our risk factors as previously reported in our Annual Report on Form 10-K for the year ended December 31, 2024, except as set forth below.

Our data systems, information systems and network infrastructure have been, and may in the future be, subject to hacking or other cybersecurity threats and other service interruptions, which could expose us to liability, impair our reputation or temporarily render us unable to fulfill our service obligations under our contracts.

As a leader in business process solutions, we leverage cloud computing, AI, machine learning and advanced analytics. We act as a trusted business partner in both front-office and back-office platforms, providing interactions on a substantial scale with our customers and other third-parties. Our customers include global commercial clients and government clients who depend upon our operational efficiency, non-interruption of service, and accuracy and security of information. We also use third-party providers such as subcontractors, software vendors, utility providers and network providers, upon whom we rely to support our business process solutions, to deliver uninterrupted, secure service. As part of our business process solutions, we also develop system software platforms necessary to support our customers’ needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases and system software solutions. We also receive, process, transmit and store substantial volumes of information relating to identifiable individuals, both in our role as a solution provider and as an employer, and we are subject to numerous laws, rules and regulations in the United States (both federal and state) and foreign jurisdictions designed to protect both individually identifiable information as well as personal health information. We also receive, process and implement financial transactions, and disburse funds, on behalf of both commercial and government customers, which activity includes receiving debit and credit card information to process payments due to our customers as well as disbursing funds to payees of our customers. As a result of these and other business process solutions, the integrity, security, accuracy and non-interruption of our systems and information technology and that of our third-party providers and our interfaces with our customers are extremely important to our business, operating results, growth, prospects and reputation.

We have in the past been, and remain, susceptible to breach of security systems which may result and has resulted in unauthorized access to our facilities and those of our customers and/or access to and exfiltration of the information we and our customers are trying to protect. Cybersecurity failure might be caused by computer hacking, compromised credentials, malware, computer viruses, worms, trojans, ransomware and other destructive software, “cyber-attacks” and other malicious activity, as well as natural disasters, power outages, terrorist attacks and similar events. Operational or business delays may also result from the disruption of network or information systems and subsequent remediation activities.

Because the techniques used to obtain unauthorized access are constantly changing and becoming increasingly more sophisticated and often are not recognized until launched against a target, we or our third-party service providers may be unable to anticipate these techniques or implement sufficient preventative measures. Unauthorized access, hacking, malware, phishing, viruses, worms, trojans, ransomware and other “cyber-attacks” have become more prevalent, have occurred in our systems in the past, and may occur in our systems in the future. Our cyber practices and cybersecurity systems may prove to be inadequate and result in the disruption, failure, misappropriation or corruption of our network and information systems and it may not be possible for us to fully or timely know if or when such incidents arise, or the full business impact of any cybersecurity breach.

Additionally, with advances in computer capabilities and data protection requirements to address ongoing threats, we may be required to expend significant capital and other resources to protect against potential security breaches or to alleviate problems caused by security breaches. Moreover, employee error or malfeasance, faulty password management or other irregularities may result in a defeat of our or our third-party service providers’ security measures and a breach of our or our third-party service providers’ information systems (whether digital, cloud-based or otherwise). In addition, the increased use of employee-owned devices for communications as well as work-from-home arrangements, present additional operational risks to our information technology systems, including, but not limited to, increased risks of cyber-attacks.

We have in the past experienced, and in the future could experience, an unauthorized party gaining physical access to one of our or one of our third-party service providers’ facilities or gain electronic access to our or one of our third-party service providers’ information systems. For example, on January 13, 2025, the Company experienced an operational disruption and learned that a threat actor gained unauthorized access to a limited portion of the Company’s environment and exfiltrated a set of files associated with a limited number of the Company’s clients. See Part II, Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operation – “Cyber Event” for additional information. This and any other such access could result in, among other things, unfavorable publicity and significant damage to our brand, governmental inquiry, oversight and possible regulatory action, difficulty in marketing our services, loss of existing and potential customers, allegations by our customers that we have not performed our contractual obligations, litigation by affected parties and possible financial obligations for substantial damages related to the theft or misuse of such information, any of which could materially adversely affect our results of operations and financial condition. Similar consequences may arise if sensitive or confidential information is misdirected, lost or stolen during transmission or transport, or is stolen or misused. Moreover, security breaches have and could require us to devote significant management resources to address the problems created by the security breach and to expend significant additional resources to upgrade further the security measures that we employ to guard such personal information against "cyber-attacks" and to maintain various systems and data centers for our customers. Often these systems and data centers must be maintained worldwide and on a 24/7 basis. We have in the past experienced and in the future could experience service interruptions that could result in curtailed operations and loss of existing and potential customers, which could significantly reduce our revenues and profits in addition to significantly impairing our reputation. If our information systems and our back-up systems are damaged, breached or cease to function properly, we may have to make a significant investment to repair or replace them, and we may suffer interruptions in our operations in the interim, each of which could materially adversely affect our results of operations and financial condition.

In addition, our and our customers’ systems and networks are subject to continued threats of terrorism, which could disrupt our operations as well as disrupt the utilities and telecommunications infrastructure on which our business depends. To the extent any such disruptions were to occur, our business, operating results and financial condition could be materially adversely affected. In addition, our liability insurance, which includes cyber insurance, might not be sufficient in type or amount to cover us, or the carrier may decline to cover us, against claims related to security incidents, cyberattacks and other related incidents.