Five9 (FIVN) Risk Factors

We plan to continue to further develop and enhance our AI-powered features, including integration of Generative AI technologies. While we aim for our AI-powered features to make agents more efficient and improve customer experience, our AI features may not achieve sufficient levels of accuracy or may not otherwise meet the needs of our clients. In addition, we may not be able to incorporate sufficient customer data and such data may contain biased or otherwise inaccurate information, resulting in unacceptable user experiences. Furthermore, our competitors or other organizations may incorporate AI features into their products more quickly or more successfully and their AI features may achieve higher market acceptance than ours, which may result in us failing to recoup our investments in developing AI-powered features and result in lost business. Should any of these factors or others occur, our ability to compete, our reputation and operating results may be materially and adversely affected.

Our success and ability to compete depend in part upon our intellectual property. As of December 31, 2023, our intellectual property portfolio included three registered U.S. trademarks, two pending U.S. trademark applications, 16 issued U.S. patents, one pending U.S. patent application and one registered U.S. copyright. As of December 31, 2023, outside the U.S. we also had 10 trademark registrations, five issued patents, and three pending international PCT patent applications. The expiration dates of our issued patents range from 2030 to 2041. We primarily rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, clients, partners and others to protect our intellectual property rights. However, the steps we take to secure, protect and enforce our intellectual property rights may be inadequate. We may not be able to obtain any further patents or trademarks, our current patents could be invalidated or our competitors could design their products around our patented technology, and our pending applications may not result in the issuance of patents or trademarks. We have pending patent applications and trademark registrations outside the U.S., and we may have to expend significant additional resources to obtain additional protection and maintain current registrations as we expand our international operations. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights in other countries are uncertain and may afford little or no effective protection of our proprietary technology, and the risk of intellectual property misappropriation may be higher in these countries. As we expand into additional countries, these risks will be further enhanced. Consequently, we may be unable to prevent our proprietary technology from being infringed or exploited abroad, which could affect our ability to expand into international markets or require costly efforts to protect our technology. In order to protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights will be costly, time consuming and distracting to our management and could result in the impairment or loss of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights, which could weaken our intellectual property protection. Accordingly, we may not be able to prevent third parties from infringing upon or misappropriating our intellectual property. Our failure to secure, protect and enforce our intellectual property rights could substantially harm the value of our technology, solutions, brand and business.

We have incorporated a number of AI-powered features into our solution, and are making investments in expanding our AI capabilities with Generative AI. Generative AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving legal and regulatory landscape. The incorporation of Generative AI-powered features into our solution may subject us to new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns, or other complications that could harm our business, reputation, financial condition or results of operations. Intellectual property ownership and license rights, including copyright, surrounding AI and Generative AI technologies has not been fully addressed by federal or state laws or by U.S. courts, and the manner in which we configure and use these technologies may expose us to claims of copyright infringement or other intellectual property misappropriation. New laws have been adopted in the EU, and it is possible that new laws and regulations will be adopted in the United States and in other countries, or that existing laws and regulations will be interpreted in ways that would affect the operation of our solution and the way in which we use AI. Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could harm our business, reputation, financial condition and results of operations. Uncertainty around and rapid evolution of Generative AI technologies may require additional investment, including research and development of new approaches and processes, which will be costly and increase our expenses. AI can generate written content which contains bias, factual errors, misrepresentations, offensive language, or inappropriate statements. While we seek to use Generative AI in a way that is designed to minimize these risks, there are still risks of such events occurring. Our failure to address these risks could harm our business, reputation, financial condition and results of operations. In addition, the use of AI, including Generative AI, involves significant technical complexity and requires specialized expertise, and competition for specialized personnel in the AI industry is intense. Any disruption or failure in our AI systems or infrastructure could result in delays or errors in our operations, which could harm our business, reputation, financial condition and results of operations.

We expect to continue to derive a significant portion of our revenues from existing clients. As a result, retaining our existing clients is critical to our future operating results. We offer monthly, annual and multiple-year contracts to our clients, generally with 30 days' notice required for reductions in the number of agent seats. Increases in the number of agent seats can be provisioned almost immediately. Our clients, therefore, are able to adjust the number of agent seats used to meet their changing contact center volume needs. Subscriptions and related usage by our existing clients may decrease if: - our clients' business or demand for our services slows or declines due to industry cycles, seasonality, business difficulties or other reasons, including the impact of macroeconomic deterioration, including continued inflation, increased interest rates, supply chain disruptions, decreased economic output and fluctuations in currency rates, the Russia-Ukraine conflict, the impact of the conflict in Israel, or other factors;- clients are not satisfied with our services, prices or the functionality of our solution;- the stability, performance or security of our solution are not satisfactory;- the U.S. or global economy declines;- clients favor products offered by other contact center providers, particularly as competition continues to increase;- fewer clients purchase usage from us;- alternative technologies, products or features emerge or gain popularity that we do not provide; or - our clients or potential clients experience financial difficulties, including as a result of macroeconomic deterioration. If our existing clients' subscriptions and related usage decrease or are terminated, we will need to spend more money to acquire new clients and still may not be able to maintain, or increase, our existing level of revenues. We incur significant costs and expenses, including sales and marketing expenses, to acquire new clients, and those costs and expenses are an important factor in determining our profitability. There can be no assurance that our efforts to acquire new clients will be successful.

Our strategy is to sell our solution to both smaller and larger organizations. Our gross margins can vary depending on numerous factors related to the implementation and use of our solution, including the features and number of agent seats purchased by our clients, the increasing reliance on public cloud providers, and the level of usage and professional services and support required by our clients. For example, our larger clients typically require more professional services, and because our professional services offerings typically have lower margins, any increase in sales of professional services could harm our gross margins and operating results. We also have lower margins on our usage revenues. Sales to larger organizations may also entail longer sales cycles and more significant selling efforts and expense. Selling to smaller clients may involve smaller contract sizes, fewer opportunities to sell additional services, a higher likelihood of contract terminations, lower returns on sales and marketing expense, fewer potential agent seats and greater credit risk and uncertainty. If the mix of organizations that purchase our solution changes, our revenues and gross margins could decrease, and our operating results could be harmed.

Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing laws and regulations related to employment and labor laws, workplace safety, environmental protection, privacy or data security, consumer protection, telecommunications services, anti-bribery, import/export controls, federal securities and taxes. In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States and in other circumstances these requirements may be more stringent in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory recalls, notification obligations, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties or injunctions. If any governmental sanctions, fines or penalties are imposed, or if we do not prevail in any civil or criminal litigation, our business, operating results, financial condition and reputation could be harmed. In addition, responding to any action will likely result in a significant diversion of management's attention and resources and an increase in professional fees. Enforcement actions and sanctions could further harm our business, operating results, financial condition and reputation.

Based on analysis of our activities, we have determined that we are obligated to collect and remit U.S. state or local sales, use, gross receipts, excise and utility user taxes, as well as fees or surcharges as a communications service provider in certain U.S. states, municipalities or local tax jurisdictions. We are registered for collecting and remitting applicable taxes where such a determination has been made. Prior to our making such determination, we neither collected nor remitted these taxes, fees or surcharges to applicable local, municipal or state jurisdictions. We continue to analyze our activities to determine if we are subject to these taxes in additional jurisdictions and based on our ongoing assessment of our U.S. state and local tax collection and remittance obligations, we register for tax and regulatory purposes in such jurisdictions and commence collecting and remitting applicable state and local taxes and surcharges to these jurisdictions. We have accrued a contingent liability of $1.7 million for our best estimate of the probable amount of taxes and surcharges that may be imposed by various states and municipalities on our activities, including our usage-based and subscription services, prior to registration. This contingent liability is based on our analysis of a number of factors, including the source location of our usage-based fees, the taxability of our subscription services and the rules and regulations in each state. The actual amount of state and local taxes and surcharges paid may differ from our estimates. See Note 10 to the consolidated financial statements. While we have accrued for these potential liabilities in each period, such accruals are based on analyses of our business activities, the operation of our solution, applicable statutes, regulations and rules in each state and locality and estimates of sales subject to sales tax or other charges. State and local taxing and regulatory authorities may challenge our position and may decide to audit our business and operations with respect to state or local sales, use, gross receipts, excise and utility user taxes, fees or surcharges, which could result in our being liable for taxes, fees, or surcharges, as well as related penalties and interest, above our recorded accrued liability or additional liability for taxes, fees, or surcharges, as well as penalties and interest for our clients, which could harm our results of operations and our relationships with our clients. In addition, if our international sales grow, additional foreign countries may seek to impose sales or other tax collection obligations on us, which would increase our exposure to liability. The applicability of state or local taxes, fees or surcharges relative to services such as ours is complex, ambiguous and subject to interpretation and change. If states enact new legislation or if taxing and regulatory authorities promulgate new rules or regulations or expand or otherwise alter their interpretations of existing rules and regulations, we could incur additional liabilities. The amount that we are required to pay under certain of these tax and regulatory structures also continues to increase as a percentage of our telecommunications revenues. The collection of additional taxes, fees or surcharges in the future could increase our prices or reduce our profit margins. Compliance with new or existing legislation, rules or regulations may also make us less competitive with those competitors who are not subject to, or choose not to comply with, such legislation, rules or regulations. We have incurred, and will continue to incur, substantial ongoing costs associated with complying with state or local tax, fee or surcharge requirements in the numerous markets in which we conduct or will conduct business.

The CCPA, CPA, CTDPA, UCPA, VCDPA, and other privacy laws in the United States apply to certain entities doing business in such states, and we and our qualifying customers were required to comply with applicable requirements as of the effective dates of the applicable state laws or corresponding regulations. The U.S. state privacy laws establish a privacy framework for covered businesses by creating an expanded definition of personal data and creating new data privacy rights for eligible residents in those states, including the right to the right to access, delete or correct such data, the right to opt out of sales or use of their personal data for targeted advertising or profiling purposes, the right to limit the use and disclosure of their sensitive personal data and the right to be free from discrimination for exercising their rights. Eligible residents of those states may also appeal any decision or indecision related to the exercise of any of their data privacy rights. As required by the statutes, covered entities also have disclosure obligations to consumers for whom they collect or process personal data. Complying with these obligations involves continued expenditures that could increase as more consumers exercise their privacy law rights. The U.S. state privacy laws create new and potentially severe statutory damages frameworks for violations of their provisions. Additionally, the CCPA creates a private right of action for consumers whose personal data is subject to a data breach. This private right of action has the potential to create significant class action liability for businesses, like ours, that operate in California. To protect against these new risks, it may be necessary to change our insurance programs. The effects of the U.S. state privacy laws are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. We anticipate that more states may enact their own comprehensive or subject matter specific privacy legislation and provide consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal data of such consumers. These laws have prompted a number of proposals for new federal and state-level privacy legislation, and related legislation affecting the use of certain types of AI-based systems and services. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

We and many of our customers are subject to the GDPR based upon our processing of personal data collected from EU data subjects, such as our processing of personal data of our customers in the EU and our processing of our EU employees' personal data. The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Non-compliance with the GDPR can trigger steep fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. The member states of the EU were tasked under the GDPR to enact certain implementing legislation that would add to or further interpret the GDPR requirements and this additional implementing legislation potentially extends our obligations and potential liability for failing to meet such obligations. Given the breadth and depth of changes in data protection obligations, our compliance with the GDPR's requirements will continue to require time, resources and review of the technology and systems we use to satisfy the GDPR's requirements. We have ongoing procedures to maintain GDPR compliance. We continue to deliver product features that enhance our data management and security in support of GDPR compliance. Among the compliance obligations the GDPR raises for us and our customers are requirements regarding the transfer of personal data from the EU to other jurisdictions, including the United States. We continue to rely on Standard Contractual Clauses, or SCCs, and have updated our use of use of SCCs to the EU's latest versions, as well as separate U.K. versions of the SCCs. Even still, there continue to be EU legal decisions and certain regulatory guidance that cast doubt on the legality of EU-U.S. data flows in general. Any inability to transfer personal data from the EU to the U.S. in compliance with data protection laws may impede our ability to attract and retain customers and adversely affect our business and financial position. As a result, it may be necessary to establish additional systems and business operations in the EU to avoid the transfer of personal data out of the EU. Should a change in the conduct of our business be required, it may involve substantial expense and the diversion of resources from other aspects of our business, all of which may harm our business and results of operations. Jurisdictions outside of the EU are also considering and/or enacting comprehensive data protection legislation. For example, on July 8, 2019, Brazil enacted the General Data Protection Law, or the LGPD, and on June 5, 2020, Japan passed amendments to its Act on the Protection of Personal Information, or the APPI. Both laws broadly regulate the processing of personal information in a manner comparable to the GDPR, and violators of the LGPD and APPI face substantial penalties. Most recently, India enacted the Digital Personal Data Protection Act, 2023, which establishes a legal framework regulating the processing of personal data in India and processing outside of India if it is related to offering goods or services to individuals in India. The law is comparable to GDPR in many ways, but also has some distinct elements, which forthcoming regulations may further clarify. We also continue to see jurisdictions, such as Russia, imposing data localization laws, which under Russian laws require personal information of Russian citizens to be, among other data processing operations, initially collected, stored, and modified in Russia. Similarly, on November 1, 2021, China's Personal Information Protection law came into effect, which places restrictions on the transfer of personal information to third parties within China or overseas. These regulations may deter customers from using services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant financial burden. The GDPR and other laws or regulations associated with the enhanced protection of certain types of personal data, could greatly increase our cost of providing our solutions and services, require significant changes to our operations or even prevent us from offering certain services in jurisdictions in which we operate. Failure to comply with data protection regulations may result in data protection authorities and other privacy regimes imposing additional obligations to obtain consent from data subjects by or on behalf of our customers. Additionally, the inability to guarantee compliance or otherwise provide acceptable privacy assurances may inhibit the sale and use of our software in the EU and certain other markets, which could, were it to occur, harm our business and operating results. Because the interpretation and application of many privacy and data protection laws (including the GDPR), commercial frameworks, and standards are uncertain, it is possible that these laws, frameworks, and standards may be interpreted and applied in a manner that is inconsistent with our existing data protection practices. If so, we and our customers are at risk of enforcement actions taken by data protection authorities or litigation from consumer advocacy groups acting on behalf of data subjects. In addition to the possibility of fines, lawsuits, breach of contract claims, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy and security or data security laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business.

To date, we have not generated significant revenues outside of the U.S., Canada, the U.K., Latin America and Australia. However, we already have significant operations outside these countries and regions, and we expect to grow our international presence in the future. Our international employees are primarily located in the Philippines, where technical support, training and other professional services are performed, Portugal, where we continue to increase our engineering and operations previously performed in Russia, and Australia, where additional portions of engineering and operations are now performed. In March 2022, we made a decision to close our Russia office and to establish a new European development center in Portugal. While approximately half of our Russian-citizen employees have received visas and have moved to Portugal, it was not feasible to move and retain all of the Russian-citizen employees in connection with growing our overall operations presence in Portugal, we have expanded recruiting and employment-related efforts in Portugal to further enhance our operations. We have and will continue to incur costs in connection with this transition, and during the transition we have and may continue to experience operational disruptions. There can be no assurance that our new Portuguese operations will be as effective or as efficient as our prior Russian operations, which could harm our business and results of operations. The future success of our business will depend, in part, on our ability to expand our operations and customer base to other countries, including our new location in Portugal. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, and political risks that are different from those in the U.S. In addition, in order to effectively market and sell our solution in international markets, we often must localize our solution, including the language in which our solution is offered, which increases our costs, could result in delays in offering our solution in these markets and may decrease the effectiveness of our sales efforts. Due to our limited experience with international operations and developing and managing sales and distribution channels in international markets, our international expansion efforts may not be successful. We also will continue to incur additional compliance costs associated with our international operations, including costs associated with expanding and rapidly changing sanctions and other trade controls. In addition, we may be unaware or unable to keep current with changes in foreign government requirements and laws as they change from time to time, which often occurs with minimal or no advance notice. Failure to comply with these regulations could harm our business. In many countries outside the United States, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or United States or international laws and regulations applicable to us. Although we have implemented policies and procedures designed to ensure compliance with these laws and policies, there can be no assurance that all of our employees, contractors, strategic partners and agents will comply with these laws and policies. Violations of laws or key control policies by our employees, contractors, strategic partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, delays in filing financial reports required as a public company, penalties, prohibitions on selling our solution or harm to our reputation, any of which could harm our business. While we have worked to avoid and mitigate any effects of the Russia-Ukraine conflict on our business, employees and clients, the conflict is ongoing, and its ultimate scope and broader impacts cannot be predicted with certainty. While the conflict has not yet had a negative impact on our employees, business, or operations outside of Russia, it could, and if the conflict or related geopolitical tensions extend to other countries, negative impacts could also expand. Our business and operations could be harmed and our costs could increase if our or our clients' or other partners' manufacturing, logistics or other operations, costs or financial performance are disrupted or adversely affected. The Russia-Ukraine conflict has also had an adverse impact on the global economy, including on the inflation rate, and has contributed to significant fluctuation in global stock markets, including The NASDAQ Stock Market, on which our common stock is listed. All of these risks and conditions could harm our future sales, business and operating results.

We rely on third-party telecommunication service providers to provide our clients and their customers with telecommunication services. These telephony services include the public switched telephone network, or PSTN, telephone numbers, call termination and origination services, and local number portability for our clients. In addition, we depend on our internet bandwidth suppliers to provide uninterrupted and error-free service through their telecommunications networks. Some of our services may require that users of our service obtain their own internet bandwidth. We exercise little control over these third-party providers, which increases our vulnerability to problems with the services they provide. When problems occur, it may be difficult to identify the source of the problem. Service disruption or outages, whether caused by our service, the products or services of our third party service providers, or our clients' or their customers' equipment and systems, may result in loss of market acceptance of our solution and harm to our reputation and any necessary repairs or other remedial actions may force us to incur significant costs and expenses. If any of these service providers fail to provide reliable services, suffer outages, degrade, disrupt, increase the cost of or terminate the services that we and our clients depend on, we may be required to switch to another service provider. Delays caused by switching our technology to another service provider, if available, and qualifying this new service provider could materially increase our costs, as well as harm our client relationships, business, financial condition and operating results. Further, any failure on the part of third party service providers to achieve or maintain expected performance levels, stability and security could harm our relationships with our clients, cause us to lose clients, result in claims for credits or damages, increase our costs or the costs incurred by our customers, damage our reputation, significantly reduce client demand for our solution and seriously harm our financial condition and operating results.