SS&C Technologies Holdings (SSNC) Risk Factors

Our business is subject to evolving and increasing U.S. and foreign regulation, including privacy, licensing, processing, recordkeeping, investment adviser, broker/dealer, retirement, data protection, reporting and related regulations. New products and services we plan to offer may also be subject to regulation, either directly or as a downstream provider to customers or clients. Such regulations cover all aspects of our business including, but not limited to, sales and trading methods, trade practices among broker/dealers, use and safekeeping of clients’ funds and securities, use of client and employee data, capital structure of securities firms, net capital, anti-money laundering efforts, healthcare, recordkeeping and the conduct of directors, officers and employees. Any violation of applicable regulations could expose us or those businesses to civil or criminal liability, significant fines or sanctions, damage our reputation, the revocation of licenses, censures, or a temporary suspension or permanent bar from conducting business, which could adversely affect our business, results of operations and our financial condition. Our clients are subject to extensive regulation, including investment adviser, broker/dealer and privacy regulations applicable to products and services we provide to the financial services industry and insurance, privacy and other regulations applicable to services we provide to the healthcare industry. As a result, our relationships with our clients may subject us to increased scrutiny from a number of regulators, including the Federal Financial Institutions Examination Council (and its constituent members, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of the Comptroller of the Currency and the Consumer Financial Protection Bureau), Australian Securities & Investments Commission, Bermuda Monetary Authority, British Virgin Islands Financial Services Commission, Centrale Bank van Curacao en Sint Maarten, Commodity Futures Trading Commission, Federal Trade Commission, Cayman Islands Monetary Authority, Luxembourg Commission de Surveillance du Secteur Financier, Financial Industry Regulatory Authority, U.K. Financial Conduct Authority, Central Bank of Ireland, National Futures Association, Guernsey Financial Services Commission, Jersey Financial Services Commission, Ontario Securities Commission, U.S. Securities and Exchange Commission, Securities Commission of the Bahamas, State Departments of Insurance through Third Party Administrator licenses, U.S. Department of Health & Human Services, U.S. Center for Medicare & Medicaid Services, U.S. Department of Defense, U.S. Office of Inspector General, U.S. Office of Civil Rights, U.S. Treasury Department and other government entities that regulate the financial services, hedge fund and hedge fund services industry in the U.S., the U.K. and the other jurisdictions in which we operate. As a result of the changes in the global economy and the turmoil in global financial markets in recent years, the risk of additional government regulation has increased. In addition, the final outcome of negotiations between the U.K. and the E.U. relating to Brexit remains uncertain. The U.K. withdrew from the E.U. on January 31, 2020, and the transition period ended on December 31, 2020. While a new bilateral trade and cooperation deal governing the future relationship between the U.K. and the E.U. was formally approved by the 27 member states of the E.U. on December 29, 2020, and the U.K. and E.U. agreed on a framework for voluntary regulatory cooperation and dialogue on financial services issues in March 2021, negotiations regarding future regulatory arrangements continue. As a result, the impact of potential changes on the U.K. regulatory regime remains uncertain. Moreover, our healthcare business is subject to evolving and increasing federal and state regulation. Such federal regulation is developed, interpreted or enforced by regulators including, the Centers for Medicare and Medicaid Services, the U.S. Dept. of Health and Human Services, the Office for Civil Rights and the Office of the Inspector General. Typically a state’s department of insurance regulates much of our healthcare business; however, each state’s statutes dictate such authority. Any of these regulations may limit or curtail our activities, including activities that might be profitable, and changes to existing regulations, or the interpretations thereof, may affect our ability to continue to offer our existing products and services, or to offer products and services we may wish to offer in the future. The E.U.’s AIFMD and the U.S. Dodd-Frank Act, among other initiatives, pose significant changes to the regulatory environment in which we and our clients operate. The impact of these regulatory changes remains uncertain. If we fail to comply with any applicable laws, rules or regulations, we may be subject to censure, fines or other sanctions, including revocation of our licenses and/or registrations with various regulatory agencies, criminal penalties and civil lawsuits. The U.S. Foreign Corrupt Practices Act (“FCPA”) and anti-bribery laws in other jurisdictions, including the U.K. Bribery Act (“Bribery Act”), generally prohibit companies and their intermediaries from making improper payments for the purpose of obtaining or retaining business or other commercial advantage. The FCPA also imposes accounting standards and requirements on publicly traded U.S. corporations and their foreign affiliates which are intended to prevent the diversion of corporate funds to the payment of bribes and other improper payments, and to prevent the establishment of “off books” slush funds from which such improper payments can be made. We and our clients operate in a number of jurisdictions that may pose a risk of potential FCPA or Bribery Act violations. Changes in, and any violation by our clients of, applicable laws and regulations (whether related to the products and services we provide or otherwise) could diminish their business or financial condition and thus their demand for our products and services or could increase our cost of continuing to provide our products and services to such industries. Demand could also decrease if we do not continue to offer products and services that help our clients comply with regulations. For example, our accounts in the healthcare industry are impacted by the Patient Protection and Affordable Care Act of 2010 (the “Affordable Care Act”), including the Health Insurance Marketplace. Changes to the Affordable Care Act have been enacted by Congress in response to the current administration’s stated agenda. In addition, we cannot predict the nature, scope or effect of future regulatory requirements to which our internal operations might be subject or the manner in which existing laws might be administered or interpreted. While our policies mandate compliance with these laws, there can be no assurance that we will be completely effective in ensuring our compliance with all applicable anti-corruption laws. A failure to comply with these laws, rules or regulations, or allegations of such noncompliance, could adversely affect our business, reputation, results of operations and financial condition.

As of December 31, 2021, we had approximately 7,300 employees located in India. The economy of India may differ favorably or unfavorably from the U.S. economy and our business may be adversely affected by the general economic conditions and economic and fiscal policy in India, including changes in exchange rates and controls, interest rates and taxation policies. In particular, in recent years, India’s government has adopted policies that are designed to promote foreign investment, including significant tax incentives, relaxation of regulatory restrictions, liberalized import and export duties and preferential rules on foreign investment and repatriations. These policies may not continue. In addition, we are subject to risks relating to social stability, political, economic or diplomatic developments affecting India in the future. India faces major challenges in the years ahead sustaining the economic growth that it has experienced over the past several years. These challenges include the need for substantial infrastructure development and improving access to healthcare and education. Our ability to recruit, train and retain qualified employees and develop and operate our facilities in India could be adversely affected if India does not successfully meet these challenges, in which case we may need to relocate those facilities and that could have a material adverse effect on our business, financial condition and results of operations.

If banks and financial services firms fail or consolidate, there could be a decline in demand for our products and services. Failures, mergers and consolidations of banks and financial institutions reduce the number of our clients and potential clients, which could adversely affect our revenues even if these events do not reduce the aggregate activities of the consolidated entities. Further, if our clients fail and/or merge with or are acquired by other entities that are not our clients, or that use fewer of our products and services, they may discontinue or reduce their use of our products and services. It is also possible that the larger financial institutions resulting from mergers or consolidations would have greater leverage in negotiating terms with us. In addition, these larger financial institutions could decide to perform in-house some or all of the services that we currently provide or could provide or to consolidate their processing on a non-SS&C system. The resulting decline in demand for our products and services over time could have a material adverse effect on our business, results of operations and financial condition.

If we are unable to keep existing clients satisfied, sell additional products and services to existing clients or attract new clients, then our revenues and net income would remain stagnant or decline. A variety of factors could affect our ability to successfully retain and attract clients, including: ? the level of demand for our products and services; ? the difficulty of potential customers to change software service providers; ? the level of client spending for IT; ? the level of competition from internal client solutions and from other vendors; ? the quality of our client service and the performance of our products; ? our ability to update our products and services and develop new products and services needed by clients; ? our ability to understand the organization and processes of our clients; and ? our ability to integrate and manage acquired businesses.

Our success and ability to compete depends in part upon our ability to protect our proprietary technology and other confidential information. We rely on a combination of patent, trade secret, copyright and trademark law, and nondisclosure agreements, license agreements and technical measures to protect our proprietary technology and other confidential information. We have registered trademarks for some of our products and will continue to evaluate the registration of additional trademarks as appropriate. We generally enter into confidentiality agreements with our employees, distributors, clients and potential clients. However, these efforts may be insufficient to prevent those parties or others from infringing, misappropriating, violating or asserting rights in our intellectual property, confidential information or other technology and our proprietary technology and confidential information may be subject to embezzlement, theft, or other similar illegal behavior by our employees or third-parties. In addition, our employees, distributors, clients and potential clients may breach our confidentiality agreements and we may not have adequate remedies for any such breach. Furthermore, unauthorized third-parties may seek to copy portions of our products or to reverse engineer or otherwise obtain and use our proprietary information. If a third-party were to gain unauthorized access to or independently develop the confidential or proprietary information we possess, we could suffer a loss of revenues, we could experience an adverse impact on our competitive position, and our relationships with our clients and our reputation could be materially adversely effected. Existing patent and copyright laws afford only limited protection. Third-parties may develop substantially equivalent or superseding proprietary technology or may offer equivalent products in competition with our products in a manner that does not infringe, misappropriate or otherwise violate our intellectual property or other proprietary rights, thereby substantially reducing the value of our proprietary rights. A number of third-parties hold patents and other intellectual property rights with application in the financial services field. Consequently, we are subject to the risk that such third-parties will claim that our products infringe, misappropriate or otherwise violate their intellectual property rights, including their patent rights. Such claims, regardless of merit, could result in expensive and time-consuming litigation, divert the attention of our personnel, and impair our intellectual property rights. Moreover, as a result of such claims, we may be required to redesign our products or services in a manner that is not infringing, misappropriating or otherwise violating such third-party’s intellectual property rights, which may not be technically or commercially feasible. We may also be required to obtain a license to such intellectual property rights, which may not be available on commercially reasonable terms or at all. Any of the foregoing could have a material adverse effect on our business, results of operation, and financial condition. We incorporate open source software into a limited number of our software products. We monitor our use of open source software in an effort to avoid subjecting our products to unfavorable conditions or conditions we do not intend. Some open source licenses require that source code subject to the license be disclosed to third-parties, grant such third-parties the right to modify and redistribute that source code and a requirement that the source code for any software derived from it be disclosed. If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public. Although we believe that we have complied with our obligations under the applicable licenses for open source software that we use, there is little or no legal precedent governing the interpretation of many of the terms of certain of these licenses. As a result, the potential impact of these terms is uncertain and may result in unanticipated obligations or restrictions regarding those of our products, technologies or solutions affected. We have acquired and may acquire important technology rights through our acquisitions and have often incorporated and may incorporate features of these technologies across many of our products and services. As a result, we are subject to the above risks and the additional risk that the seller of the technology rights may not have appropriately protected the intellectual property rights we acquired. Indemnification and other rights under applicable acquisition documents are limited in term and scope and therefore provide us with only limited protection. In addition, we rely on third-party software in providing some of our products and services. If we lose our licenses to use such software or if such licenses are found to infringe, misappropriate or otherwise violate upon the rights of others, we will need to seek alternative means of obtaining the licensed software to continue to provide our products or services, which may not be feasible on a technical or commercial basis. Our inability to replace such software, or to replace such software in a timely manner, could significantly disrupt our business and our ability to deliver products and services to our clients, and adversely affect our business, results of operation and financial condition.

Our software-enabled services maintain and process confidential data and process trades and perform other back-office functions, including wiring funds, on behalf of our clients, some of which is critical to their business operations. For example, our trading systems maintain account and trading information for our clients and their customers. In addition, following our acquisition of Intralinks in 2018, our platforms house sensitive, confidential client information. Our internal technology infrastructure on which our software-enabled services depend may be subject to disruptions or may otherwise fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control and that could adversely affect our ability to process transactions, provide services or otherwise appropriately conduct our business activities. Such events include IT attacks or failures, threats to physical security, sudden increases in transaction volumes, electrical or telecommunications outages, damaging weather or other acts of nature, or employee or contractor error or malfeasance. In particular, cybersecurity threats have become prevalent in our industry as well as for many firms that process information. Cybersecurity threats are evolving and our security measures, and those of our service providers, may not detect or prevent all attempts to hack our systems, denial-of-service attacks, viruses, malicious software, attempts to gain unauthorized access to data, phishing attacks, social engineering, security breaches or employee or contractor malfeasance and other electronic security breaches that may jeopardize the security of information stored in or transmitted by our sites, networks and systems or that we or our third-party service providers otherwise maintain. Such cyber security incidents could lead to disruptions in our systems, the unauthorized release or destruction of our or our clients’ or other parties’ confidential or otherwise protected information and corruption of data. We and our service providers may not have the resources or technical sophistication to anticipate or prevent all types of attacks, and techniques used to obtain unauthorized access to or sabotage systems change frequently and may not be known until launched against us or our third-party service providers. In the last few years there have been many successful advanced cyber-attacks that have damaged several prominent companies in spite of strong information security measures, and we expect that the risks associated with cyber-attacks and the costs of preventing such attacks will continue to increase in the future. We and our clients are regularly the target of attempted cyber-attacks and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Although we expend significant resources and oversight efforts in an attempt to ensure that we maintain appropriate safeguards with respect to cyber-attacks, there is no guarantee that our systems and procedures are adequate to protect against all security breaches. If our software-enabled services are disrupted or fail for any reason, or if our systems or facilities are infiltrated or damaged by unauthorized persons, we and our clients could experience data loss, including confidential and personal information, financial loss, harm to their reputation and significant business interruption. If that happens, we may be exposed to significant liability, our reputation may be harmed, our clients may be dissatisfied and we may lose business. Although we maintain privacy, data breach and network security liability insurance, we cannot be certain that our coverage will be adequate or cover liabilities actually incurred, or that insurance will continue to be available to us on economically reasonable terms, or at all. Given the unpredictability of the timing, nature and scope of such failures or disruptions, we could potentially experience significant costs and exposures, including production downtimes, operational delays, other detrimental impacts on our operations or ability to provide services to our customers, the compromising of confidential or otherwise protected information, misappropriation, destruction or corruption of data, security breaches, other manipulation or improper use of our systems or networks, financial losses from remedial actions, loss of business, potential liability, regulatory inquiries, enforcements, actions and fines and/or damage to our reputation, any of which could have a material adverse effect on our business, results of operations and financial condition.

The COVID-19 pandemic continues to create significant volatility, uncertainty and economic disruption in the markets in which we operate. Although initial measures to limit the spread of COVID-19 have been relaxed or terminated in most jurisdictions, new variants have been identified, and this may lead to new measures being put back in place if COVID-19 spreads further in the future. While we were not materially affected in 2021, the potential effects on our business continue to remain uncertain and difficult to predict due to ongoing uncertainty about the duration, magnitude and impact of the COVID-19 pandemic, not to mention the volatile regional and global economic conditions resulting from the pandemic. Some of these potential effects could include: • significant failures, errors, delays, disruptions or instability affecting our key products or services, vendors, suppliers, distributors, IT platforms, data centers, production and delivery systems, applications or processes; • volatile market conditions and reduced demand for our products and services; and • amplified strain on our workforce, management and other resources, including employee absenteeism, complications from working remotely and illness of key personnel. These effects, alone or taken together, could have a material adverse effect on our business, financial condition or results of operations, which could be exacerbated if the pandemic is sustained or prolonged. We cannot assure you that we will be successful in our attempts to mitigate any negative effects of this pandemic on our business. We are closely monitoring the impact of the pandemic, continually assessing its potential effects on our business and taking appropriate actions in accordance with the recommendations and requirements of relevant authorities. The extent to which the pandemic may impact our operational and financial performance remains uncertain and will depend on many factors outside of our control, including the timing, extent, trajectory and duration of the pandemic; the emergence, spread and severity of new variants; the development, availability, distribution and effectiveness of vaccines and treatments; the imposition of protective public safety measures, including vaccine and testing mandates; and the impact of the pandemic on the global economy. While these factors are uncertain, the COVID-19 pandemic or the perception of its effects could have a material adverse effect on our business, financial condition, results of operations or cash flows.