Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 94

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 94
---
 comply with certain federal and state regulations applicable to them. For example, as a result of obligations under some of our customer contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy and data security laws because of the solutions we provide to FIs. The GLBA includes limitations on FI's disclosure of nonpublic personal information about a consumer to nonaffiliated third parties, in certain circumstances requiring FIs to limit the use and further disclosure of nonpublic personal information to nonaffiliated third parties and requiring FIs to safeguard nonpublic personal information. Banking regulations for information security and breach notification also impose obligations on us due to our relationships with customers that increase our information security obligations and customers may impose additional information security standards upon us, such as those relating to the New York Department of Financial Services Cybersecurity Regulation (“Cybersecurity Regulation) or the National Association of Insurance Commissioner’s Insurance Data Security Model Law, which are both intended to establish standards for data security and standards for the investigation and notification of data breaches applicable to insurance licensees.  As of February 1, 2025, a version of the Insurance Data Security Model law has been adopted in more than 25 jurisdictions. Both the Cybersecurity Regulation and Insurance Data Security Model Law require oversight of third-party service providers with respect to information security, among other things. Matters subject to review and examination by federal and state FI regulatory agencies and external auditors include our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities, and the design of our solutions. Any inability to satisfy these examinations and maintain compliance with applicable regulations could adversely affect our ability to conduct our business, including attracting and maintaining customers. If we have to make changes to our 

19

internal processes and solutions as result of these regulations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency.

The evolving, complex, and often unpredictable regulatory environment in which our customers operate could result in our failure to provide compliant solutions, which could result in customers not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible. In addition, federal, state, and/or foreign agencies may attempt to further regulate our activities in the future which could adversely affect our business and results of operations.

Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and