Five9 (FIVN) Risk Analysis

In order to remain competitive, we must devote significant and increasing resources to develop new solution offerings, features and enhancements to our existing cloud contact center software, which will increase our research and development and operating expenses, and potentially divert resources from other areas of our operations. Our research and development expenses totaled $152.3 million, $166.2 million and $156.6 million for the years ended December 31, 2025, 2024 and 2023, respectively. Maintaining adequate research and development personnel and resources to meet the demands of the market is essential. If we are unable to develop products, applications or features internally due to constraints, such as high employee turnover, insufficient cash, other cash needs of our business, inability to hire sufficient research and development personnel or a lack of other research and development resources, we may miss market opportunities. Furthermore, many of our competitors have greater financial resources and expend greater amounts on their research and development programs than we do, and those that do not may be acquired by larger companies that would allocate greater resources to our competitors' research and development programs. Resource limitations may result in inadequate research and development funding or may result in an inability to compete effectively with the research and development programs of our competitors, either of which could harm our business.

In the ordinary course of business, we enter into agreements of varying scope and terms pursuant to which we agree to indemnify customers, vendors, lessors, business partners and other parties for third-party claims with respect to certain matters, including losses arising out of breach of such agreements, certain claims related to third-party privacy or cyber security breaches or from intellectual property infringement claims made by third parties. We have received, and will likely continue to receive, indemnification demands from customers regarding our intellectual property indemnification obligations under these contracts. In addition, we have entered into indemnification agreements with our directors, officers and certain employees that will require us, among other things, to indemnify them against certain liabilities that may arise by reason of their status or service as directors, officers or employees. Large indemnity payments or damage claims from contractual breach could harm our business, results of operations and financial condition. Although we typically contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them. Any dispute with a customer with respect to such obligations could be expensive, even if we ultimately prevail, and could harm our relationship with that customer and other current and prospective customers, reduce demand for our solution and harm our business, results of operations and financial condition.

Our solution includes software covered by open source licenses. Few open source licenses have been interpreted by courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our solution. Although we have implemented policies to regulate the use of open source software in connection with our products and services, we cannot be certain that we have not used open source software in a manner that is inconsistent with such policies. If we fail to comply with open source licenses applicable to us, we could be subject to certain requirements, including requirements that we release the source code of our proprietary software and to make our proprietary software available under open source licenses, if we combine our proprietary software with certain open source software in a certain manner. In the event that portions of our proprietary software are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the commercial licensing of our technologies, each of which could reduce or eliminate the value of our intellectual property, and solutions. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Given the nature of open source software, there is also a risk that third parties may assert copyright and other intellectual property infringement claims against us based on our use of that open source software. Many of the risks associated with the use of open source software cannot be eliminated and could harm our business.

The FCC's implementation of KARI's Law and the RAY BAUM's Act imposed a requirement on operators of interconnected multiline telephone systems ("MLTS") to ensure their users can directly dial 911 emergency services and, if technically feasible, automatically convey the caller's dispatchable location information with the call. The 911 service requirement applies to all new MLTS systems installed and MLTS customers activated after February 16, 2020. The FCC's decision also means that MLTS system operators may be subject to state and local fee assessments imposed on telecommunications carriers to support the operation of 911 public safety call centers. Our service is arguably analogous with a virtual MLTS system. Therefore, we implemented 911 calling capabilities for all of our clients that agreed to receive such services, regardless of whether the client relationship predated February 16, 2020. Our 911 service includes the provision of dispatchable location information, but requires contact center agents to register their physical location. Although we believe our 911 service implementation is fully compliant with FCC requirements, application of the FCC's rules to our service required certain interpretive assumptions and a contrary conclusion by the FCC could expose us to FCC enforcement action, including fines and other penalties. Further, we have been contacted by regulators in one state regarding possible assessments for 911 support fees to cover the costs of 911 public safety call centers in that state. Although such assessments, if imposed on us, are not substantial, they could increase the cost of doing business and potentially make our services less attractive as compared to competing virtual call center service providers that have not implemented 911 service capabilities as a part of their service offerings.

Based on analysis of our activities, we have determined that we are obligated to collect and remit U.S. state or local sales, use, gross receipts, excise and utility user taxes, as well as fees or surcharges as a communications service provider in certain U.S. states, municipalities or local tax jurisdictions. We are registered for collecting and remitting applicable taxes where such a determination has been made. Prior to our making such determination with respect to a particular state, municipality, or local tax jurisdiction, we neither collected nor remitted these taxes, fees or surcharges for such jurisdiction. We continue to analyze our activities to determine if we are subject to these taxes in additional jurisdictions and based on our ongoing assessment of our U.S. state and local tax collection and remittance obligations, we register for tax and regulatory purposes in such jurisdictions and commence collecting and remitting applicable state and local taxes and surcharges to these jurisdictions. We have accrued a contingent liability of $1.7 million for our best estimate of the probable amount of taxes and surcharges that may be imposed by various states and municipalities on our activities, including our usage-based and subscription services, for periods prior to our registration and collection in such jurisdictions. This contingent liability is based on our analysis of a number of factors, including the source location of our usage-based fees, the taxability of our subscription services and the rules and regulations in each state. The actual amount of state and local taxes and surcharges paid may differ from our estimates. See Note 10 to the consolidated financial statements. While we have accrued for these potential liabilities in each period, such accruals are based on analyses of our business activities, the operation of our solution, applicable statutes, regulations and rules in each state and locality and estimates of sales subject to sales tax or other charges. State and local taxing and regulatory authorities may challenge our position and may decide to audit our business and operations with respect to state or local sales, use, gross receipts, excise and utility user taxes, fees or surcharges, which could result in our being liable for taxes, fees, or surcharges, as well as related penalties and interest, above our recorded accrued liability or additional liability for taxes, fees, or surcharges, as well as penalties and interest for our customers, which could harm our results of operations and our relationships with our customers. In addition, if our international sales grow, additional foreign countries may seek to impose sales or other tax collection obligations on us, which would increase our exposure to liability. The applicability of state or local taxes, fees or surcharges relative to services such as ours is complex, ambiguous and subject to interpretation and change. If states enact new legislation or if taxing and regulatory authorities promulgate new rules or regulations or expand or otherwise alter their interpretations of existing rules and regulations, we could incur additional liabilities or collection obligations. The amount that we are required to pay under certain of these tax and regulatory structures also continues to increase as a percentage of our telecommunications revenues. The collection of additional taxes, fees or surcharges in the future could increase our prices or reduce our profit margins. Compliance with new or existing legislation, rules or regulations may also make us less competitive with those competitors who are not subject to, or choose not to comply with, such legislation, rules or regulations. We have incurred, and will continue to incur, substantial ongoing costs associated with complying with state or local tax, fee or surcharge requirements in the numerous markets in which we conduct or will conduct business.

State privacy laws in the United States apply to certain entities doing business in their states, and we and our qualifying customers were required to comply with applicable requirements as of the effective dates of the applicable state laws or corresponding regulations. The U.S. state privacy laws establish a privacy framework for covered businesses by creating an expanded definition of personal data and creating new data privacy rights for eligible residents in those states, including the right to the right to access, delete or correct such data, the right to opt out of sales, sharing, or the use of their personal data for targeted advertising or profiling purposes, the right to request a list of third parties to whom the company sells or shares personal data, the right to limit the use and disclosure of their sensitive personal data and the right to be free from discrimination for exercising their rights. Eligible residents of those states may also appeal any decision or indecision related to the exercise of any of their data privacy rights. As required by the statutes, covered entities also have disclosure obligations to consumers for whom they collect or process personal data. Complying with these obligations involves continued expenditures that could increase as more consumers exercise their privacy law rights, and as more laws are enacted that vary from each other in material ways. The U.S. state privacy laws create new and potentially severe statutory damages frameworks for violations of their provisions. Additionally, the CCPA creates a private right of action for consumers whose personal data is subject to a data breach. This private right of action has the potential to create significant class action liability for businesses, like ours, that operate in California. To protect against these new risks, it may be necessary to change our insurance programs and there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a such liability or that such coverage will continue to be available on commercially reasonable terms or at all. The effects of the U.S. state privacy laws are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. We anticipate that more states may enact their own comprehensive or subject matter specific privacy and AI-focused legislation and provide consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal data of such consumers. These laws have prompted a number of proposals for new federal and state-level privacy legislation, and related legislation affecting the use of certain types of AI-based systems and services. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. U.S. state laws are continuing to evolve in and around regulation of AI technologies. States such as California, Colorado, Utah and Texas have enacted new legislation, and additional legislation is expected to be passed during the upcoming 2026 legislative session in additional states. The California Privacy Protection Agency has also promulgated new regulations on the use of automated decision-making technologies. Although the new state laws and regulations have specific applicability thresholds that do not apply to the vast majority of AI use cases in our industry, we incur costs associated with monitoring and evaluating these laws, and when these laws apply, we incur compliance-related costs. We incur costs associated with a fragmented landscape of laws, because there is as yet no federal AI law. We could face additional costs if new laws are enacted either at the state or federal level that apply, or could apply, to our products or services, or if current laws are amended to apply to our products or services. In the event that new AI regulation were to be enacted that more heavily scrutinizes or restricts our current AI applications, products, features, or services, we could be required to remove certain products or product features from our solution.

Our business depends on our ability to satisfy our customers, not only with respect to our solution, but also with the professional services and technical support that are required for our customers to implement and use our solution to address their business needs. Professional services and technical support may be performed by our own staff or, in some cases, by third parties. Our professional services offerings currently have negative margins. Accordingly, any increase in sales of professional services could harm our gross margins and operating results. We will need to continue to considerably expand our professional services and technical support in order to implement and support new and larger global customer installations. Identifying and recruiting qualified service personnel and training them in our solution is difficult and competitive and requires significant time, expense and attention. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services. We also may be unable to modify the format of our support services or change our pricing to compete with changes in support services provided by our competitors. To the extent we experience increased customer demand for these services, and are unable to increase corresponding revenue, our costs would increase and our operating results could be harmed. If a customer is not satisfied with the deployment and ongoing services performed by us or a third party, we could lose customers, miss opportunities to expand our business with these customers, incur additional costs, or suffer reduced (including negative) margins on our service revenue, any of which could damage our ability to grow our business. In addition, negative publicity related to our professional services and technical support, regardless of its accuracy, may damage our business by affecting our ability to compete for new business with current and prospective customers.

To increase our revenue, we must add new customers and continue to expand within our installed customer base. As our industry matures, as our customers experience macroeconomic issues or seasonal trends in their business, or as competitors introduce lower cost or differentiated products or services that are perceived to compete favorably with ours, our ability to add new customers and renew, maintain or sell additional services to existing customers could be harmed. As a result, our existing customers may not renew our agreements or may decrease their number of licenses or their consumption of our AI solutions, and we may be unable to attract new customers or grow or maintain our business with existing customers, which could harm our revenue and growth. For example, our installed base business, which contributes a significant portion of our annual revenue growth, continues to experience macroeconomic challenges. To grow our business in the longer term, we plan to add new customers that are government entities. We have made, and plan to continue to make, investments to support future customer opportunities in the government sector. Some U.S. government customers require that we be authorized under the FedRAMP to help satisfy their own legal and regulatory compliance requirements, which requires us to undertake additional actions and expense to ensure compliance. In preparation for potentially obtaining FedRAMP, we are currently undergoing processes and procedures to obtain FedRAMP authorization, which processes and procedures are costly and time consuming. There are no assurances that we will be able to obtain such authorizations or that if obtained, this authorization will result in increased revenue or a sufficient return on our investment. Furthermore, a portion of our revenue is generated by acquiring domestic and international telecommunications minutes from wholesale telecommunication service providers and reselling those minutes to our customers. We have experienced, and expect to continue to experience, lower sales of minutes to our customers as many of our larger customers are using their own minutes. In addition, as telecommunications rates continue to decrease, we may not be able to resell more minutes to maintain our level of usage revenue.

We and many of our customers are subject to the GDPR based upon our processing of personal data collected from EU data subjects, such as our processing of personal data of our customers in the EU and our processing of our EU employees' personal data. Similar obligations apply under the U.K. General Data Protection Regulation (UK GDPR). The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Non-compliance with the GDPR can trigger steep fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Given the breadth and depth of changes in data protection obligations, our compliance with the GDPR's requirements will continue to require time, resources and review of the technology and systems we use to satisfy the GDPR's requirements. We have ongoing procedures to maintain GDPR compliance. We continue to deliver product features that enhance our data management and security in support of GDPR compliance. Among the compliance obligations the GDPR raises for us and our customers are requirements regarding the transfer of personal data from the EU to other jurisdictions, including the United States. We continue to rely on Standard Contractual Clauses, or SCCs, and have updated our use of SCCs to the EU's latest versions, as well as separate U.K. versions of the SCCs. Even still, there continue to be EU legal decisions and certain regulatory guidance that cast doubt on the legality of EU-U.S. data flows in general. Any inability to transfer personal data from the EU to the U.S. in compliance with data protection laws may impede our ability to attract and retain customers and adversely affect our business and financial position. As a result, it may be necessary to establish additional systems and business operations in the EU to avoid the transfer of personal data out of the EU. Should a change in the conduct of our business be required, it may involve substantial expense and the diversion of resources from other aspects of our business, all of which may harm our business and results of operations. Jurisdictions outside of the EU are also considering and/or enacting comprehensive data protection legislation. For example, the General Data Protection Law in Brazil, or the LGPD, and the Japanese Act on the Protection of Personal Information, or the APPI, broadly regulate the processing of personal information in a manner comparable to the GDPR, and violators of the LGPD and APPI face substantial penalties. Most recently, India enacted the Digital Personal Data Protection Act, 2023, which establishes a legal framework regulating the processing of personal data in India and processing outside of India if it is related to offering goods or services to individuals in India. The law is comparable to GDPR in many ways, but also has some distinct elements, which forthcoming regulations may further clarify. Similarly, China's Personal Information Protection law places restrictions on the transfer of personal information to third parties within China or overseas. These regulations may deter customers from using services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant financial burden. The GDPR and other laws or regulations associated with the enhanced protection of certain types of personal data could greatly increase our cost of providing our solutions and services, require significant changes to our operations or even prevent us from offering certain services in jurisdictions in which we operate. Failure to comply with data protection regulations may result in data protection authorities and other privacy regimes imposing additional obligations to obtain consent from data subjects by or on behalf of our customers. Additionally, the inability to guarantee compliance or otherwise provide acceptable privacy assurances may inhibit the sale and use of our software in the EU and certain other markets, which could, were it to occur, harm our business and operating results. Because the interpretation and application of many privacy and data protection laws (including the GDPR), commercial frameworks, and standards are uncertain, it is possible that these laws, frameworks, and standards may be interpreted and applied in a manner that is inconsistent with our existing data protection practices. If so, we and our customers are at risk of enforcement actions taken by data protection authorities or litigation from consumer advocacy groups acting on behalf of data subjects. In addition to the possibility of fines, lawsuits, breach of contract claims, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy and security or data security laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business. Similarly, the European Union passed legislation related to artificial intelligence, cybersecurity, and data access, including the EU Artificial Intelligence Act, Regulation (EU) 2024/1689; the NIS 2 Directive, Directive (EU) 2022/2555; and the Data Act, Regulation (EU) 2023/2854. We closely monitor this legislation, along with efforts to update the legislation with the recent Digital Omnibus on AI Regulation and Digital Omnibus Regulation proposals. Compliance with these regulations may increase our costs and the costs of our customers with respect to ensuring compliance with these laws. If we fail to comply where required to do so, we can face substantial fines and penalties along with commercial and reputational challenges when doing business in the European Economic Area.

A key element of our growth strategy is to expand our international sales efforts and develop a more global customer base. Because of our limited experience with international sales, our international expansion may not be successful and may not produce the return on investment we expect. To date, we have realized only a small portion of our revenues from customers outside the United States, with approximately 89% of our revenue for the year ended December 31, 2025 derived from customers with billing addresses in the United States. We have increased and are continuing to increase our sales, marketing and support personnel in both the U.K. and the European Union. We have enlarged our data centers in the U.K. and Amsterdam and are increasing our use of public cloud solutions in the European Union as well. Operating in international markets requires significant resources and management attention and subjects us to intellectual property, regulatory, tax, economic and political risks that are different from, and often more stringent than, those in the United States. As we increase our international sales efforts and continue and increase our other international operations, we will face increased risks in doing business internationally that could harm our business, including: - the need to establish and protect our brand in international markets;- the need to localize and adapt our solution for specific countries, including translation into foreign languages and associated costs and expenses;- difficulties in staffing and managing foreign operations, particularly hiring and training qualified sales and service personnel;- the need to implement and offer customer care, in various languages;- different pricing environments, longer sales and accounts receivable payment cycles and collections issues;- weaker protection for intellectual property and other legal rights than in the U.S. and practical difficulties in enforcing intellectual property and other rights outside of the U.S., leading to increased risk of piracy, counterfeiting and other misappropriation of our intellectual property;- privacy and data protection laws and regulations that are complex, expensive to comply with and may require that customer data be stored and processed in a designated territory;- new and different sources of competition, including laws and business practices favoring local competitors;- general economic conditions in international markets, including increased financial accounting and reporting burdens and complexities and potential adverse tax consequences;- fluctuations in the value of the U.S. dollar and foreign currencies, which may make our solution more expensive in other countries or may increase our costs, impacting our operating results when translated into U.S. dollars;- compliance challenges related to the complexity of multiple, conflicting and changing governmental laws and regulations, including employment, tax, telecommunications and telemarketing laws and regulations;- increased risk of international telecom fraud;- laws and business practices favoring local competitors;- compliance with laws and regulations applicable to foreign operations and cross border transactions, including the Foreign Corrupt Practices Act, the U.K. Bribery Act and other anti-corruption laws, supply chain restrictions, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our solution in certain foreign markets, and the risks and costs of non-compliance;- restrictions or taxes on the transfer of funds; and - unstable economic and political conditions and potential accompanying shifts in laws and regulations. These risks could harm our international operations, increase our operating costs and hinder our ability to grow our international business and, consequently, our overall business and results of operations.

Our solution incorporates certain third-party software obtained under licenses from other companies, including AI-based offerings. We anticipate that we will continue to rely on current and new software from third parties in the future. Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not be the case, or may not be the case for new software that we license, or it may be difficult or costly to transition to other providers. In addition, integration of the software used in our solution with new third-party offerings may require significant work and require substantial investment of our time and resources. To the extent that our solution depends upon the successful operation of third-party software in conjunction with our solutions, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our solution, delay new product or solution introductions, result in increased costs, or a failure of our solution, harm our reputation and damage our relationships with our customers. Our use of additional or alternative third-party software would require us to enter into license agreements with third parties, which could increase our costs, and integrate this new software with our solution. There can be no assurance that the technology licensed by us will continue to provide competitive features and functionality or that licenses for technology currently utilized by us or other technology that we may seek to license in the future, including to replace current third-party software, will be available to us at a reasonable cost or on commercially reasonable terms, or at all. Third-party licensors may also be acquired or go out of business, which could preclude us from continuing to use their technology. The loss of, or inability to maintain, existing licenses could result in lost product features and litigation. The loss of existing licenses could also result in implementation delays or reductions until equivalent technology or suitable alternative solutions could be developed or identified, and licensed and these replacements integrated, and could harm our business through increased costs or the inability to offer competitive features to new or existing customers in a timely fashion, or at all.