Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 88

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 88
---
 on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers. 

NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

The EU Digital Operational Resilience Act (“DORA”), which applied from January 17, 2025, imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers. DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered ‘critical’ within the meaning of DORA. Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with ICT third-party service providers.

DORA does not provide for minimum or maximum monetary sanctions but empowers EU Member State competent authorities to enforce DORA and determine the appropriate sanction on the basis of the factors set out in DORA, including the gravity and duration of the infringement. Sanctions may be administrative or criminal in nature, and DORA also provides that individual members of the management body can be held personally liable for any non-compliance.

We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations. Any such laws, rules, and regulations may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of information including financial and PII, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve.

Any failure or perceived failure by us, or any third parties with which we do business, to comply