EPAM Systems Inc.: 10-K Risk Factor Changes

Expectations from our clients, investors, employees, and regulators regarding our environmental, social, and governance, or ESG, strategy and commitments continue to evolve. As investor policy and sentiment changes, and regulations and legislation related to ESG disclosure and climate change initiatives are adopted or suspended regionally and globally, our compliance obligations may not be aligned with investor, political, or legal support for ESG investments, programs, and disclosure. Failure to invest in and comply with ESG initiatives and regulations could limit our access to certain markets, result in fines, or cause reputational harm, and commitment to ESG policies and programs could similarly harm our business and reputation with investors, clients, and the public. Changes in policy and laws may require disclosures and commitments that we are not able to meet, and regulations, treaties or initiatives related to climate change could result in increased operational costs associated with environmental regulations and increased compliance and energy costs, each of which could harm our business and results of operations by increasing our expenses or requiring us to alter our operations. Our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting ESG metrics, including ESG-related disclosures that may be required or expected by regulation or industry norms, and such standards may change over time, which could result in significant revisions to our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future. Additionally, if we are unable to meet our ESG goals and objectives, we could also face scrutiny from certain constituencies related to the scope and nature of those goals or any revisions to those goals, and we may suffer reputational harm with investors, our clients, and current or potential employees. 14 14 14 14 14 14 Table of Contents Table of Contents Table of Contents

Expectations from our customers, investors, employees, and regulators regarding our environmental, social, and governance, or ESG, strategy and commitments continue to evolve. As investor policy and sentiment changes, and regulations and legislation related to ESG disclosure and climate change initiatives are adopted and implemented regionally and globally, our compliance obligations may not be completely aligned with investor support for ESG investments. Failure to invest in and comply with ESG initiatives and regulations could limit our access to certain markets, result in fines, or cause reputational harm. Changes in policy and laws may require disclosures and commitments that we are not able to meet, and regulations, treaties or initiatives in response to climate change could result in increased operational costs associated with environmental regulations and increased compliance and energy costs, each of which could harm our business and results of operations by increasing our expenses or requiring us to alter our operations. Our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting ESG metrics, including ESG-related disclosures that may be required of public companies by the SEC or other regulatory bodies, and such standards may change over time, which could result in significant revisions to our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future. Additionally, if we are unable to meet our ESG goals and objectives, we could also face scrutiny from certain constituencies related to the scope and nature of those goals or any revisions to those goals, and we may suffer reputational harm with investors, our customers, and current or potential employees.

We have been incorporating AI, and particularly generative AI, into our products, services, and business, both due to client demand and because we expect that integrating generative AI into our services is a competitive requirement in a rapidly evolving market. We have made significant investments to build and support AI capabilities, products, and services to meet clients’ needs and remain competitive in our industry and expect to make additional investments in the future. If we are unable or slow to develop, adopt, and deploy generative AI technologies in our business, we will not remain competitive against our industry peers. Generative AI technologies have changed how we identify, recruit, hire, retain, and efficiently utilize our professionals and are changing how we can charge for their services. Our clients have asked, and may come to expect, that we use generative AI along with human delivery personnel to develop software for them at comparatively lower costs than software developed solely by our human delivery personnel. As we plan, develop, and implement changes to our delivery model to balance those services that can only be performed by humans against those that can be performed leveraging generative AI, we may have insufficient or excess delivery personnel than we require to meet client demand. Clients may be unwilling to pay rates for human delivery personnel if they perceive that the same services can be performed less expensively by generative AI and may seek other service providers or expect price concessions to retain their business, which could adversely affect our financial results.

We are increasingly incorporating AI, and particularly generative AI, into our products, services, and business, both due to customer demand and because we expect that integrating generative AI into our services is required to remain competitive in a rapidly evolving market. We have made and expect to continue to make significant development and operations investments to build and support AI capabilities, products, and services so that we can meet the needs of our customers and remain competitive in our industry. If we are unable or slow to develop, adopt, and deploy generative AI technologies in our business, our competitiveness against our industry peers will suffer. Generative AI technologies could disrupt the significant effort we put into identifying, recruiting, hiring, retaining, and efficiently utilizing our professionals and our ability to charge for their services. Our customers have asked, and may come to expect, that we use generative AI to develop software for them at comparatively lower costs than software developed by our human delivery personnel. As we plan, develop, and implement changes to our delivery model to balance those services that can only be performed by humans against those that can be performed by generative AI, we may have insufficient or excess delivery personnel than required to meet customer demand. Customers may be unwilling to pay rates for human delivery personnel if they perceive that the same services can be performed by less expensive generative AI and may seek other service providers or price concessions to retain their business, which could adversely affect our financial results.

In the ordinary course of business, we collect, store, process, transmit, and view sensitive or confidential data, including intellectual property, proprietary business information and personally identifiable information belonging to us, our clients, our respective employees, and other end users. This information is stored in our data centers and networks or in the data centers and networks of third-party providers. Physical security and the secure storage, processing, maintenance and transmission of this information are critical to our operations, business strategy, and reputation. Our internal technology infrastructure or the technology infrastructure of our third-party providers on which our information security depends may be subject to disruptions or may otherwise fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control and that could adversely affect our ability to provide services or keep our information secure. Such events include IT attacks or failures, threats to physical security, electrical or telecommunications outages, damaging weather or other acts of nature, or employee or contractor error or malfeasance. Our employees, contractors, vendors, software and hardware suppliers, and other third parties in our information security supply chain, as well as sophisticated individual or collective groups of hackers, such as state-sponsored organizations, all pose threats to our information security. These individual, group, and organized actors have a variety of methods at their disposal, including deploying malicious software, exploiting vulnerabilities in hardware, software, or infrastructure, using social engineering or deceptive techniques to obtain information or gain access to our or our clients’ or vendors’ data, exploiting remote working connectivity and security susceptibilities, and executing coordinated attacks to compromise our services, disrupt our operations, damage our reputation, or gain access to our communications, networks and data centers. 20 20 20 20 20 20 Table of Contents Table of Contents Table of Contents We have in the past experienced cybersecurity incidents and expect to continue to be the target of malicious attacks. Threats to information security evolve constantly and are increasingly sophisticated and complex, which makes detecting and successfully defending against them more difficult. Undetected vulnerabilities that persist in our network environment over long periods of time could spread within our networks or into the networks and systems of our suppliers and clients. An attack viewed as immaterial or isolated at the time of its occurrence can later become material or part of a larger and coordinated effort. We frequently update and improve our information security environment and assess and adopt new methods, devices, and technologies, but our policies and information security controls may not keep pace or be designed to detect emerging threats and our response to incidents may not be adequate, may fail to accurately assess the severity of an incident, may not be fast enough to prevent or limit harm, or may fail to sufficiently remediate an incident. Our ability to monitor our third-party suppliers’ information security systems is limited and we are not able to detect vulnerabilities in their systems until we are notified of the existence of those vulnerabilities. There have been and will continue to be attacks on our and third parties’ information security supply chains. We cannot guarantee that our information security supply chain has not been breached and does not contain exploitable defects, bugs, or vulnerabilities that could result in an incident, breach, or other disruption to our system or the systems of our clients or suppliers. Despite our multiple security measures, any breach of our facilities, network, or information security defenses compromises the information stored in those locations and allows the accessed information to be held for ransom, publicly disclosed, misappropriated, lost or stolen. Such a breach, misappropriation, or disruption, or the perception that we have been breached or are vulnerable to a breach, disrupts our operations and the services we provide to clients, and any actual, alleged, or perceived breach of network or information security that we suffer damages our reputation, causes a loss of confidence in our products and services, and requires us to expend significant resources, which may not be covered by insurance, to protect against further allegations and breaches and to rectify problems caused by these events. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability under applicable laws, regulatory penalties or enforcement actions, and could adversely affect our reputation, business, revenues and competitive position.

In the ordinary course of business, we collect, store, process, transmit, and view sensitive or confidential data, including intellectual property, proprietary business information and personally identifiable information belonging to us, our customers, our respective employees, and other end users. This information is stored in our data centers and networks or in the data centers and networks of third-party providers. Physical security and the secure storage, processing, maintenance and transmission of this information is critical to our operations and business strategy. Our internal technology infrastructure or the technology infrastructure of our third-party providers on which our information security depends may be subject to disruptions or may otherwise fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control and that could adversely affect our ability to provide services or keep our information secure. Such events include IT attacks or failures, threats to physical security, electrical or telecommunications outages, damaging weather or other acts of nature, or employee or contractor error or malfeasance. Our employees and contractors and our vendors, software and hardware suppliers, and other third parties in our information security supply chain, as well as sophisticated individual or collective groups of hackers, such as state-sponsored organizations, all pose threats to our information security. These individual, group, and organized actors have a variety of methods at their disposal, including deploying malicious software, exploiting vulnerabilities in hardware, software, or infrastructure, using social engineering or deceptive techniques to obtain information or gain access to our or our customers’ data, exploiting remote working connectivity and security susceptibilities, and executing coordinated attacks to compromise our services, disrupt our operations or gain access to our communications, networks and data centers. We have in the past experienced cybersecurity incidents and expect to continue to be the target of malicious attacks. Threats to information security evolve constantly and are increasingly sophisticated and complex, which makes detecting and successfully defending against them more difficult. Undetected vulnerabilities that persist in our network environment over long periods of time could spread within our networks or into the networks and systems of our other suppliers and customers. An attack may be viewed as immaterial or isolated at the time of its occurrence but later viewed as material or part of a larger and coordinated effort at a later date. We frequently update and improve our information security environment and assess and adopt new methods, devices, and technologies, but our policies and information security controls may not keep pace or be designed to detect emerging threats and our response to incidents may not be adequate, may fail to accurately assess the severity of an incident, may not be fast enough to prevent or limit harm, or may fail to sufficiently remediate an incident. Our ability to monitor our third-party suppliers’ information security systems is limited and we are not able to detect vulnerabilities in their systems until we are notified of the existence of those vulnerabilities. There have been and will continue to be attacks on our and third parties’ information security supply chains. We cannot guarantee that our information security supply chain has not been breached and does not contain exploitable defects, bugs, or vulnerabilities that could result in an incident, breach, or other disruption to our system or the systems of our customers or suppliers. Despite our multiple security measures, any breach of our facilities, network, or information security defenses compromises the information stored in those locations and allows the accessed information to be held for ransom, publicly disclosed, misappropriated, lost or stolen. Such a breach, misappropriation, or disruption, or the perception that we are vulnerable to a breach, could also disrupt our operations and the services we provide to customers, and any actual, alleged, or perceived breach of network or information security that we, our suppliers, our customers, or our industry suffer could damage our reputation, and cause a loss of confidence in our products and services, as well as require us to expend significant resources, which may not be covered by insurance, to protect against further breaches and to rectify problems caused by these events. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability under applicable laws, regulatory penalties or enforcement actions, and could adversely affect our business, revenues and competitive position. 21 21 21 21 21 21 Table of Contents Table of Contents Table of Contents

A substantial portion of our clients are concentrated in five industry verticals: Financial Services; Software & Hi-Tech; Business Information & Media; Consumer Goods, Retail & Travel; and Life Sciences & Healthcare. Our business growth largely depends on continued demand for our services from clients in these five industry verticals and other industries that we target now or in the future and also depends on trends in these industries to outsource the services we provide. 16 16 16 16 16 16 Table of Contents Table of Contents Table of Contents A downturn in any of our targeted industries, a slowdown or reversal of the trend to outsource IT services in any of these industries or the introduction of regulations that restrict or discourage companies from outsourcing could result in a decrease in the demand for our services and could have a material adverse effect on our business, financial condition and results of operations. Some of our clients have experienced lay-offs, volatile stock prices, higher borrowing costs, and lower consumer spending on products and services which has resulted in reduced spending on our and other outsourced services. Other developments in the industries in which we operate may increase the demand for lower cost or lower quality IT services and decrease the demand for our services or increase the pressure our clients put on us to reduce pricing. We may not be able to successfully anticipate and prepare for any such changes, which could adversely affect our results of operations. Furthermore, developments in the industries we serve shift client demand to new services, solutions or technology, such as generative AI. If our clients demand new services, solutions or technologies, we may be less competitive in these new areas if we do not make significant investments to meet that demand. Additionally, as we expand into serving new industry verticals, our solutions and technology may be used by, or generally affect, a broader base of clients and end users, which may expose us to new business and operational risks.

A substantial portion of our customers are concentrated in five specific industry verticals: Financial Services; Software & Hi-Tech; Business Information & Media; Travel & Consumer; and Life Sciences & Healthcare. Our business growth largely depends on continued demand for our services from customers in these five industry verticals and other industries that we target or may target in the future, and also depends on trends in these industries to outsource the type of services we provide. A downturn in any of our targeted industries, a slowdown or reversal of the trend to outsource IT services in any of these industries or the introduction of regulations that restrict or discourage companies from outsourcing could result in a decrease in the demand for our services and could have a material adverse effect on our business, financial condition and results of operations. Some of our customers in the Software & Hi-Tech industry vertical have experienced lay-offs, depressed stock prices, higher borrowing costs, and lower consumer spending on technology products and services which has resulted in reduced spending on our and other outsourced services. Other developments in the industries in which we operate may increase the demand for lower cost or lower quality IT services and decrease the demand for our services or increase the pressure our customers put on us to reduce pricing. We may not be able to successfully anticipate and prepare for any such changes, which could adversely affect our results of operations. Furthermore, developments in the industries we serve could shift customer demand to new services, solutions or technology. If our customers demand new services, solutions or technologies, we may be less competitive in these new areas or may need to make significant investments to meet that demand. Additionally, as we expand into serving new industry verticals, our solutions and technology may be used by, or generally affect, a broader base of customers and end users, which may expose us to new business and operational risks.

We have experienced uneven growth, expansion, geographic shifts, and periods of decline in our business over the past several years. Our growth and expansion have been both organic and through strategic acquisitions and investments and has resulted in part from managing larger and more complex projects for our clients. Consequently, we have and may continue to invest substantial amounts of cash in human capital and the infrastructure to support these projects, including training, administration, and opening facilities in existing and new geographies. Our growth has significantly slowed at times, particularly during 2023 and the first half of 2024, due to reduced client demand resulting primarily from uncertain macroeconomic conditions. Rapid growth followed by decreased demand placed significant strain on our management and our administrative, operational and financial infrastructure, and created and may continue to create challenges, including: •recruiting, training and retaining sufficiently skilled professionals and management personnel while balancing headcount with client requirements; •balancing an increase in the number of experienced personnel that have correspondingly higher billing rates due to promotions against hiring, training, and deploying less experienced personnel at the lower rates sought by clients; •planning and maintaining resource utilization rates consistently and efficiently using on-site, off-site, near shore, and offshore staffing; •developing and maintaining close and effective relationships with potential and existing clients in a greater number of industries and locations; •controlling costs and minimizing cost overruns and project delays in our delivery operations and infrastructure; •effectively maintaining productivity levels and implementing process improvements across geographies and businesses during periods of uneven client demand; and •evolving our information security and our internal administrative, operational and financial infrastructure. If clients do not choose us for large and complex projects or we do not effectively manage those projects, our reputation may be damaged and we will not realize our business and financial goals that support new investments and infrastructure projects. We have and will continue to invest in new lines of business, such as software development education, AI and generative AI, expanded consulting services, and in new geographies. As we introduce new services, enter into new markets and new client relationships, and take on increasingly large and complex projects, our business will face new risks and challenges. Expansion into direct-to-consumer offerings in the highly regulated education industry and joint venture relationships with our clients could result in increased liability, start-up, and compliance costs. If the challenges associated with expansion and new investments negatively impact our anticipated growth and margins, our business, prospects, financial condition and results of operations could be materially adversely affected.

We have experienced uneven growth and expansion of our business over the past several years. Our growth and expansion has been both organic and through strategic acquisitions and investments and has resulted in part from managing larger and more complex projects for our customers, but consequently requires that we invest substantial amounts of cash in human capital and the infrastructure to support them, including training, administration, and facilities in existing and new geographies. Our growth has significantly slowed at times, particularly during 2023, due to waning customer demand, primarily due to uncertainty resulting from macroeconomic conditions following the COVID-19 pandemic. Rapid growth followed by decreased demand places significant strain on our management and our administrative, operational and financial infrastructure, and creates challenges, including: •recruiting, training and retaining sufficiently skilled professionals and management personnel and balancing headcount with customer requirements; •balancing an increase in the number of experienced personnel that have correspondingly higher billing rates due to promotions with hiring, training, and deploying less experienced personnel at the lower rates sought by customers; •planning and maintaining resource utilization rates consistently and efficiently using on-site, off-site and offshore staffing; •developing and maintaining close and effective relationships with potential and existing customers in a greater number of industries and locations; •controlling costs and minimizing cost overruns and project delays in our delivery operations and infrastructure; •effectively maintaining productivity levels and implementing process improvements across geographies and business units during periods of uneven customer demand; and •evolving our information security and our internal administrative, operational and financial infrastructure. If customers do not choose us for large and complex projects or we do not effectively manage those projects, our reputation may be damaged and our business and financial goals will not be realized. We need to generate business and revenues to support new investments and infrastructure projects. We have and will continue to invest in new lines of business, such as software development education, AI, and expanded consulting services. As we introduce new services, enter into new markets and new customer relationships, and take on increasingly large and complex projects, our business will face new risks and challenges. Expansion into direct-to-consumer offerings in the highly regulated education industry and joint venture relationships with our customers could result in increased liability, start-up, and compliance costs. If the challenges associated with expansion and new investments negatively impact our anticipated growth and margins, our business, prospects, financial condition and results of operations could be materially adversely affected.

Errors made by our professionals when delivering services or failures to meet our contractual obligations are disruptive to the client’s business and can expose confidential or personally identifiable information to third parties. These events have resulted and could in the future result in a reduction in our revenues, damage to our reputation, and in clients terminating our engagement and making claims for substantial damages against us. Some of our client agreements do not limit our potential liability for occurrences such as breaches of confidentiality and intellectual property infringement, and we cannot generally limit the liability to third parties with which we do not have a contractual relationship. In some cases, breaches of confidentiality obligations, including obligations to protect personally identifiable information, may entitle the aggrieved party to equitable remedies, including injunctive relief. Although we maintain professional liability insurance, product liability insurance, cyber incident insurance, commercial general and property insurance, business interruption insurance, workers’ compensation coverage, and umbrella insurance for certain of our operations, our insurance coverage does not insure against all risks in our operations, or all claims we may receive. Damage claims brought against us, claims that we initiate due to the disruption of our business, information security systems, litigation, or natural disasters, and claims from reputational damage resulting from inaccurate allegations or reporting may not be covered by our insurance, may exceed the limits of our insurance coverage, and may result in substantial costs and diversion of resources even if insured. Some types of insurance are not available on reasonable terms or at all in some countries in which we operate, and we cannot insure against damage to our reputation. The assertion of one or more large claims against us, even if unsuccessful or insured, could materially adversely affect our reputation, business, financial condition, stock price, and results of operations. 18 18 18 18 18 18 Table of Contents Table of Contents Table of Contents

Errors made by our professionals in the course of delivering services or our failure to meet our contractual obligations to a customer are disruptive to the customer’s business and can expose confidential or personally identifiable information to third parties. These events have resulted and could in the future result in a reduction in our revenues, damage to our reputation, and in customers terminating our engagement and making claims for substantial damages against us. Some of our customer agreements do not limit our potential liability for occurrences such as breaches of confidentiality and intellectual property infringement indemnity, and we cannot generally limit liability to third parties with which we do not have a contractual relationship. In some cases, breaches of confidentiality obligations, including obligations to protect personally identifiable information, may entitle the aggrieved party to equitable remedies, including injunctive relief. 18 18 18 18 18 18 Table of Contents Table of Contents Table of Contents Although we maintain professional liability insurance, product liability insurance, cyber incident insurance, commercial general and property insurance, business interruption insurance, workers’ compensation coverage, and umbrella insurance for certain of our operations, our insurance coverage does not insure against all risks in our operations or all claims we may receive. Damage claims from customers or third parties brought against us or claims that we initiate due to the disruption of our business, information security systems, litigation, or natural disasters, may not be covered by our insurance, may exceed the limits of our insurance coverage, and may result in substantial costs and diversion of resources even if insured. Some types of insurance are not available on reasonable terms or at all in some countries in which we operate, and we cannot insure against damage to our reputation. The assertion of one or more large claims against us, whether or not successful and whether or not insured, could materially adversely affect our reputation, business, financial condition and results of operations.

Our success largely depends on our ability to use and develop our technology, tools, code, methodologies, products, and services without infringing the intellectual property rights, including patents, copyrights, trade secrets and trademarks, of third parties. We have been subject to intellectual property infringement claims alleging that we used third party trademarks or copyrighted materials without permission. If those intellectual property rights were relevant to our service offerings, we would need to license those rights or we would be prevented from using the allegedly infringing intellectual property in our business. We typically indemnify clients who purchase our products, services and solutions against potential infringement of third-party intellectual property rights, which subjects us to the risk and cost of defending the underlying infringement claims. These claims require us to initiate or defend litigation on behalf of our clients, regardless of the merits of these claims, and our indemnification obligations are sometimes not subject to liability limits or exclusion of consequential, indirect or punitive damages. Intellectual property litigation diverts our management’s attention from our business and existing or potential clients could defer or limit their purchase or use of our software product development services or solutions until we resolve such litigation. If any of these claims succeed, we may be forced to pay damages on behalf of our clients, redesign or cease offering our allegedly infringing products, services, or solutions, or obtain licenses for the allegedly infringing intellectual property. If we cannot obtain licenses on commercially reasonable terms, our clients may be forced to stop using our services or solutions. In addition, the existence and ownership of intellectual property rights created by generative AI technologies is currently subject to judicial and legislative review, and many jurisdictions do not recognize the existence of any protectable intellectual property rights in materials created by generative AI. If we are unable to meet our clients’ expectations relating to the ownership of the intellectual property underlying software deliverables, we may face legal liability. We believe AI software developers occasionally indemnify their licensees against intellectual property claims, but we think it is unlikely such indemnification obligations would cover our potential damages, if any. Any of these actions, regardless of the outcome of licensing negotiations, litigation, or merits of the claim, could damage our reputation and materially adversely affect our business, financial condition and results of operations.

Our success largely depends on our ability to use and develop our technology, tools, code, methodologies, products, and services without infringing the intellectual property rights, including patents, copyrights, trade secrets and trademarks, of third parties. We may be unaware of intellectual property rights relating to our products or services that may give rise to potential infringement claims against us, including the extensive litigation related to ownership of intellectual property rights associated with the images and text used to train generative AI software. Authors and other copyright holders seek to hold developers of generative AI software liable for using their copyrighted materials without permission and may seek to hold us or our customers liable for contributing to the infringement of their copyrighted materials. If those intellectual property rights are relevant to our service offerings, we may need to license those rights on commercially reasonable terms in order to continue to use the applicable technology. There may also be technologies licensed to and relied on by us that if subject to infringement or misappropriation claims by third parties, may become unavailable to us if such third parties obtain an injunction to prevent us from delivering our services or using technology involving the allegedly infringing intellectual property. If we are unable to license technologies needed for our business, we typically indemnify customers who purchase our products, services and solutions against potential infringement of third-party intellectual property rights, which subjects us to the risk and cost of defending the underlying infringement claims. These claims require us to initiate or defend litigation, which may be costly and protracted, on behalf of our customers, regardless of the merits of these claims, and our indemnification obligations are often not subject to liability limits or exclusion of consequential, indirect or punitive damages. Intellectual property litigation could also divert our management’s attention from our business and existing or potential customers could defer or limit their purchase or use of our software product development services or solutions until we resolve such litigation. If any of these claims succeed, we may be forced to pay damages on behalf of our customers, redesign or cease offering our allegedly infringing products, services, or solutions, or obtain licenses for the intellectual property that such services or solutions allegedly infringe. If we cannot obtain all necessary licenses on commercially reasonable terms, our customers may be forced to stop using our services or solutions. In addition, the existence and ownership of intellectual property rights created by generative AI technologies is currently subject to judicial and legislative review, and many jurisdictions do not recognize the existence of any protectable intellectual property rights in materials created by generative AI. If we are unable to meet our customers’ expectations relating to the ownership of the intellectual property underlying software deliverables, we may face legal liability. We believe AI software developers occasionally indemnify their licensees against intellectual property claims, but we think it is unlikely such indemnification obligations would cover our potential damages, if any. Any of these actions, regardless of the outcome of licensing negotiations, litigation, or merits of the claim, could damage our reputation and materially adversely affect our business, financial condition and results of operations. 20 20 20 20 20 20 Table of Contents Table of Contents Table of Contents

We enter into foreign currency forward contracts with a number of counterparties. As a result, we are subject to the risk that the counterparty to one or more of these contracts defaults on its performance under the contract. During an economic downturn, the counterparty’s financial condition may deteriorate rapidly and with little notice and we may be unable to take action to protect our exposure. In the event of a counterparty default, we could incur significant losses, which may harm our business and financial condition. In the event that one or more of our counterparties becomes insolvent or files for bankruptcy, our ability to eventually recover any losses suffered as a result of that counterparty’s default may be limited by the liquidity of the counterparty.

We enter into foreign currency forward contracts with a number of counterparties. As a result, we are subject to the risk that the counterparty to one or more of these contracts defaults on its performance under the contract. During an economic downturn, the counterparty’s financial condition may deteriorate rapidly and with little notice and we may be unable to take action to protect our exposure. In the event of a counterparty default, we could incur significant losses, which may harm our business and financial condition. In the event that one or more of our counterparties becomes insolvent or files for bankruptcy, our ability to eventually recover any losses suffered as a result of that counterparty’s default may be limited by the liquidity of the counterparty. 23 23 23 23 23 23 Table of Contents Table of Contents Table of Contents

Changes in general economic or political conditions in the U. S. could adversely affect our business. U.S. policy with respect to a variety of issues, including AI, international trade agreements, conducting business offshore, inflation mitigation, interest rates, climate change, import and export regulations, tariffs and customs duties, foreign relations, immigration laws and travel restrictions, antitrust controls and enforcement, and corporate governance laws, could have a positive or negative impact on our business. The U.S. administration has announced plans to levy tariffs, economic sanctions, and other restrictions on trade with the countries where we employ professionals and conduct significant operations and may also levy restrictions with little or no warning. The majority of our professionals are offshore. Companies that outsource services to organizations operating in other countries remain a topic of political discussion in many countries, including the U. S., which is our largest source of revenues. The U.S. administration periodically proposes rules that could impose restrictions on offshore outsourcing and on our ability to deploy employees holding U.S. work visas to client locations, both of which could adversely impact our business. Such measures could broaden restrictions on outsourcing by federal and state government agencies and contracts and impact private industry with tax disincentives, intellectual property transfer restrictions, and restrictions on the use or availability of certain work visas. Some of our projects require our personnel to obtain visas to travel and work at client sites outside of our personnel’s home countries and often in the U.S. Our reliance on visas to staff projects with employees who are not citizens of the country where the work is performed makes us vulnerable to changes in the number of visas to be issued in any particular year and other work permit laws and regulations. Obtaining the required visas and work permits can be lengthy and difficult due to political forces and economic conditions limiting the number of permitted applications and application and enforcement processes may cause delays or rejections when trying to obtain visas. Delays in obtaining visas or other work authorizations may delay the ability of our personnel to travel to meet with and provide services to our clients or to continue to provide services on a timely basis. In addition, the availability of a sufficient number of visas without significant additional costs could limit our ability to provide services to our clients on a timely and cost-effective basis or manage our sales and delivery centers as efficiently as we otherwise could. Delays in or the unavailability of visas and work permits could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Changes in general economic or political conditions in the United States, including a recession, government shutdown, or a sovereign debt default, could adversely affect our business. U.S. policy with respect to a variety of issues, including AI, international trade agreements, conducting business offshore, inflation mitigation, interest rates, import and export regulations, tariffs and customs duties, foreign relations, immigration laws and travel restrictions, antitrust controls and enforcement, and corporate governance laws, could have a positive or negative impact on our business. The majority of our professionals are offshore. Companies that outsource services to organizations operating in other countries remain a topic of political discussion in many countries, including the United States, which is our largest source of revenues. The U.S. Congress periodically proposes legislation that could impose restrictions on offshore outsourcing and on our ability to deploy employees holding U.S. work visas to customer locations, both of which could adversely impact our business. Such legislative measures could broaden restrictions on outsourcing by federal and state government agencies and contracts and impact private industry with tax disincentives, intellectual property transfer restrictions, and restrictions on the use or availability of certain work visas. Some of our projects require our personnel to obtain visas to travel and work at customer sites outside of our personnel’s home countries and often in the United States. Our reliance on visas to staff projects with employees who are not citizens of the country where the work is to be performed makes us vulnerable to legislative and administrative changes in the number of visas to be issued in any particular year and other work permit laws and regulations. The process to obtain the required visas and work permits can be lengthy and difficult and variations due to political forces and economic conditions in the number of permitted applications, as well as application and enforcement processes, may cause delays or rejections when trying to obtain visas. Delays in obtaining visas or other work authorizations may result in delays in the ability of our personnel to travel to meet with and provide services to our customers or to continue to provide services on a timely basis. In addition, the availability of a sufficient number of visas without significant additional costs could limit our ability to provide services to our customers on a timely and cost-effective basis or manage our sales and delivery centers as efficiently as we otherwise could. Delays in or the unavailability of visas and work permits could have a material adverse effect on our business, results of operations, financial condition and cash flows. 15 15 15 15 15 15 Table of Contents Table of Contents Table of Contents

Our success heavily depends upon the continued services of our senior executives and other key employees. If one or more of our senior executives or key employees are unable or unwilling to continue in their present positions, we may not be able to replace them easily or at all. If any of our senior executives or key personnel joins a competitor or forms a competing company, they may take clients, suppliers, know-how and our personnel with them. If we are unable to attract new senior executives or key personnel due to the intense competition for talent in our industry, it could disrupt our business operations and growth. Although we regularly perform succession planning efforts and create contingencies addressing the risks of losing senior executives and other key personnel, those efforts may be ineffective when or if they are deployed. 12 12 12 12 12 12 Table of Contents Table of Contents Table of Contents

Our future success heavily depends upon the continued services of our senior executives and other key employees. If one or more of our senior executives or key employees are unable or unwilling to continue in their present positions, we may not be able to replace them easily or at all. If any of our senior executives or key personnel joins a competitor or forms a competing company, we may lose customers, suppliers, know-how and other key personnel to those competitors. If we are unable to attract new senior executives or key personnel due to the intense competition for talent in our industry, it could disrupt our business operations and growth. 12 12 12 12 12 12 Table of Contents Table of Contents Table of Contents

We are subject to many laws and regulations that restrict our international operations, including laws that prohibit activities involving restricted countries, organizations, entities and persons that have been identified as unlawful actors or that are subject to U.S. sanctions. The U.S. Office of Foreign Assets Control, or OFAC, and other domestic and international bodies have imposed sanctions that prohibit us from engaging in trade or financial transactions with certain countries, businesses, organizations and individuals. We are also subject to anti-bribery and anti-corruption laws, all of which prohibit companies and their intermediaries from making bribes for the purpose of obtaining or keeping business or otherwise obtaining favorable treatment. We operate in many parts of the world that have experienced government corruption to some degree, and, in certain circumstances, strict compliance with anti-bribery laws may conflict with local customs and practices, although adherence to local customs and practices is generally not a defense under U.S. and other anti-bribery laws. 15 15 15 15 15 15 Table of Contents Table of Contents Table of Contents Our compliance program contains controls and procedures designed to ensure our compliance with anti-bribery and anti-corruption laws, sanctions, and other laws and regulations. The continuing implementation and ongoing development and monitoring of our compliance program may be time consuming, expensive, and could result in the discovery of compliance issues or violations by us or our employees, independent contractors, subcontractors or agents of which we were previously unaware. Any violations of these or other laws and regulations by our employees, independent contractors, subcontractors and agents, including third parties with which we associate or companies we acquire, could expose us to administrative, civil or criminal penalties, fines or business restrictions, which could have a material adverse effect on our results of operations and financial condition and would adversely affect our reputation and the market for shares of our common stock and may require certain of our investors to disclose their investment in us under certain state laws.

We are subject to many laws and regulations that restrict our international operations, including laws that prohibit activities involving restricted countries, organizations, entities and persons that have been identified as unlawful actors or that are subject to U.S. sanctions. The U.S. Office of Foreign Assets Control, or OFAC, and other international bodies have imposed sanctions that prohibit us from engaging in trade or financial transactions with certain countries, businesses, organizations and individuals. We are also subject to the FCPA and anti-bribery and anti-corruption laws in other countries, all of which prohibit companies and their intermediaries from bribing government officials for the purpose of obtaining or keeping business or otherwise obtaining favorable treatment. We operate in many parts of the world that have experienced government corruption to some degree, and, in certain circumstances, strict compliance with anti-bribery laws may conflict with local customs and practices, although adherence to local customs and practices is generally not a defense under U.S. and other anti-bribery laws. Our compliance program contains controls and procedures designed to ensure our compliance with the FCPA, OFAC and other sanctions, and laws and regulations. The continuing implementation and ongoing development and monitoring of our compliance program may be time consuming, expensive, and could result in the discovery of compliance issues or violations by us or our employees, independent contractors, subcontractors or agents of which we were previously unaware. Any violations of these or other laws, regulations and procedures by our employees, independent contractors, subcontractors and agents, including third parties with which we associate or companies we acquire, could expose us to administrative, civil or criminal penalties, fines or business restrictions, which could have a material adverse effect on our results of operations and financial condition and would adversely affect our reputation and the market for shares of our common stock and may require certain of our investors to disclose their investment in us under certain state laws.

Identifying, recruiting, hiring and retaining professionals with skill sets that meet our existing and anticipated demand across our business is critical to maintaining existing engagements and obtaining new business but has become more challenging in changing economic and labor climates. If we are unable to recruit professionals with the skills required by our business and if we do not productively deploy our professionals, infrastructure, and fixed-cost resources productively, our profitability will be significantly impacted. Additionally, if we are unable to effectively train existing personnel to develop new skills and adequately maintain existing skills, our ability to win new work and successfully complete existing projects may be impaired. We must manage the utilization levels of our professionals by effectively planning for future needs and staffing projects appropriately while accurately predicting the general economy, the geographies and locations where our personnel are needed, and our clients’ need for our services. If we are unable to attract, hire, train, and retain highly skilled personnel and productively deploy them on client projects, we will jeopardize our ability to meet our clients’ expectations and develop current and future business, which could adversely affect our financial condition and results of operations. 11 11 11 11 11 11 Table of Contents Table of Contents Table of Contents Competition for highly skilled professionals and wage expectations is intense in the markets where we operate or plan to operate, and we may experience significant employee turnover rates or recruiting challenges due to such competition. If we are unable to retain professionals with specialized skills, our revenues, operating efficiency and profitability will decrease, as will our ability to meet emerging technological challenges. Cost reductions, such as reducing headcount or voluntary departures that result from our failure to retain the professionals we hire, negatively affect our reputation as an employer and our ability to hire personnel to meet our business requirements. We may be unable to obtain price increases in-line with increasing compensation to retain personnel which may have an adverse impact on our profitability.

Identifying, recruiting, hiring and retaining professionals with skill sets that meet our existing and anticipated demand across our broad geography of operations is critical to maintaining existing engagements and obtaining new business and has become more challenging in the changing economic and labor climate. If we are unable to recruit professionals with the skills required by our business and customers and/or if we do not productively deploy those professionals and use our physical infrastructure and fixed-cost resources productively, our profitability will be significantly impacted. We must manage the utilization levels of the professionals that we hire and train by planning for future needs effectively and staffing projects appropriately while accurately predicting the general economy and our customers’ need for our services. If we are unable to attract, hire, train, and retain highly skilled personnel and productively deploy them on customer projects, we will jeopardize our ability to meet our customers’ expectations and develop ongoing and future business, which could adversely affect our financial condition and results of operations. 11 11 11 11 11 11 Table of Contents Table of Contents Table of Contents Competition for highly skilled professionals has intensified in the markets where we operate, and we may experience significant employee turnover rates due to such competition. Higher wage expectations driven by wage inflation could also create challenges for our recruiting efforts. If we are unable to retain professionals with specialized skills, our revenues, operating efficiency and profitability will decrease, as will our ability to meet emerging technological challenges. Cost reductions, such as reducing headcount or voluntary departures that result from our failure to retain the professionals we hire, negatively affect our reputation as an employer and our ability to hire personnel to meet our business requirements. Price increases resulting from increasing compensation to retain personnel may be a contributing factor in a decline in demand for our services.

To defend against information security threats internally, at our third-party providers, and on our clients’ systems, we must continuously engineer or purchase more secure products and services, enhance security and reliability features, improve deployment and compliance with software updates, assess and develop mitigation strategies and technologies to help secure information, hire information security specialists, and maintain a security infrastructure that protects our network, products, and services, and the software we build for our clients. Some of our clients seek additional assurances for the protection of their sensitive information, including personally identifiable information, and attempt to hold us liable, through contractual indemnification clauses or directly, for any losses or damages related to the disclosure of their sensitive information. At times and to achieve commercial objectives, we agree to greater liability exposure to such clients. In addition, government regulators have sought and may continue to seek to impose fines, penalties, and other civil or criminal consequences for real or suspected security breaches and perceived inadequate information security or disclosures. Our clients, particularly those in the Financial Services and Life Sciences & Healthcare industry verticals, may have enhanced or particular security requirements which we must address in our engineering and development services. Other parties, such as our clients’ customers, who have a private right of action, will seek damages for any information security or privacy breach on an individual or collective basis, and our clients have in the past, and may in the future, request to be indemnified against such claims. We must also educate our employees, contractors, and clients about the need to effectively use security measures. The cost of information security measures, either to protect our information or the information of our clients, and the cost of complying with privacy and information security disclosure regulations, reduces our profitability. Actual or perceived security vulnerabilities in our software and services, even if those vulnerabilities are the result of hardware or software developed by third parties, harm our reputation and lead clients to use our competitors, reduce or delay future purchases of our services, or seek compensation or damages. 21 21 21 21 21 21 Table of Contents Table of Contents Table of Contents

To defend against information security threats internally, at our third-party providers, and on our customers’ systems, we must continuously engineer or purchase more secure products and services, enhance security and reliability features, improve deployment and compliance with software updates, assess and develop mitigation strategies and technologies to help secure information, hire information security specialists, and maintain a security infrastructure that protects our network, products, and services, and the software we build for our customers. Some of our customers seek additional assurances for the protection of their sensitive information, including personally identifiable information, and attempt to hold us liable, through contractual indemnification clauses or directly, for any losses or damages in the event that their sensitive information is disclosed. At times, to achieve commercial objectives, we agree to greater liability exposure to such customers. In addition, government regulators have sought and may continue to seek to impose fines, penalties, and other civil or criminal consequences for real or suspected security breaches and perceived inadequate information security. Our customers, particularly those in the Financial Services and Life Sciences & Healthcare industry verticals, may have enhanced or particular security requirements which we must address in our engineering and development services. Other parties, such as our customers’ customers, who have a private right of action, will seek damages for any information security or privacy breach on an individual or collective basis, and our customers have in the past, and may in the future, request to be indemnified against such claims. We must also educate our employees, contractors, and customers about the need to effectively use security measures. The cost of information security measures, either to protect our information or the information of our customers, and the cost of complying with privacy and information security disclosure regulations, reduces our profitability. Actual or perceived security vulnerabilities in our software and services, even if those vulnerabilities are the result of hardware or software developed by third parties, harm our reputation and lead customers to use our competitors, reduce or delay future purchases of our services, or seek compensation or damages.

We have a long selling cycle for our services. Before potential clients commit to use our services, we must expend substantial time and resources educating them on the value of our services and our ability to meet their requirements. Therefore, our selling cycle is subject to many risks and delays over which we have little or no control, including our clients’ decision to select another service provider or use in-house resources to perform the services, the timing of our clients’ budget cycles, and client procurement and approval processes. If our sales cycle unexpectedly lengthens for one or more large projects, it could negatively affect the timing of our revenues and our revenue growth. In certain cases, we may begin work and incur costs prior to executing a contract, which may cause fluctuations in recognizing revenues between periods or jeopardize our ability to collect payment from clients. Implementing our services also involves a significant commitment of resources over an extended period of time from both our clients and us. Our current and future clients may not be willing or able to invest the time and resources necessary to implement our services, and we may fail to close sales with potential clients despite devoting significant time and resources. Any significant failure to generate revenues or delays in recognizing revenues after incurring costs related to our sales or services processes could have a material adverse effect on our business. 17 17 17 17 17 17 Table of Contents Table of Contents Table of Contents

We have a long selling cycle for our services. Before potential customers commit to use our services, they require us to expend substantial time and resources educating them on the value of our services and our ability to meet their requirements. Therefore, our selling cycle is subject to many risks and delays over which we have little or no control, including our customers’ decision to select another service provider or in-house resources to perform the services, the timing of our customers’ budget cycles, and customer procurement and approval processes. If our sales cycle unexpectedly lengthens for one or more large projects, it could negatively affect the timing of our revenues and our revenue growth. In certain cases, we may begin work and incur costs prior to executing a contract, which may cause fluctuations in recognizing revenues between periods or jeopardize our ability to collect payment from customers. Implementing our services also involves a significant commitment of resources over an extended period of time from both our customers and us. Our current and future customers may not be willing or able to invest the time and resources necessary to implement our services, and we may fail to close sales with potential customers despite devoting significant time and resources. Any significant failure to generate revenues or delays in recognizing revenues after incurring costs related to our sales or services processes could have a material adverse effect on our business.

Strategic acquisitions involve significant risks but remain a key part of our growth strategy. Acquired companies may not advance our business strategy or achieve a satisfactory return on our investment, we may not be able to successfully integrate acquired employees, businesses, company cultures, client relationships, or operations, and we may not discover significant liabilities in our due diligence or valuation processes. In addition, we may need to implement controls, processes, and policies in our acquired companies so they are consistent and appropriate with the requirements of a multi-national public company especially in areas such as financial reporting, cybersecurity, IT, and privacy and may rely on transition services from the sellers until we are able to implement those controls, processes, and policies. Furthermore, our acquired companies’ contracts with their clients sometimes lack terms and conditions that adequately protect us against the risks associated with the services we provide, and our acquired companies’ legacy business operations can expose us to potential liability. Acquisitions also divert significant management attention and financial resources from our ongoing business. If not effectively managed, the disruption to our ongoing business increases our expenses, including significant one-time expenses and costs related to unknown liabilities, including tax, litigation, cybersecurity, and commercial risks, and creates difficulty and complexity when integrating acquired operations that can adversely affect our overall growth and profitability.

Strategic acquisitions are part of our growth strategy, but these transactions involve significant risks. Acquired companies may not advance our business strategy or achieve a satisfactory return on our investment and we may not be able to successfully integrate acquired employees, businesses, company cultures, customer relationships, or operations. In addition, we may need to implement controls, processes, and policies appropriate for a multi-national public company at acquired companies that may have previously lacked such controls, processes, and policies in areas such as cybersecurity, IT, and privacy. Acquisitions divert significant management attention and financial resources from our ongoing business. Furthermore, contracts between our acquired companies and their customers sometimes lack terms and conditions that adequately protect us against the risks associated with the services we provide, and our acquired companies’ business operations can expose us to potential liability before integration is complete. If not effectively managed, the disruption of our ongoing business, increases in our expenses, including significant one-time expenses and write-offs, assumption of unknown liabilities, including tax, litigation, cybersecurity, and commercial risks, and difficulty and complexity of effectively integrating acquired operations may adversely affect our overall growth and profitability.

In Belarus, we are a member of High-Technologies Park which provides for a full exemption from Belarus income and value added taxes until 2049 and reduced tax amounts on obligatory social contributions and other taxes. Poland provides a tax incentive for research and development that allows us to take enhanced deductions for specific costs for employees working on research and development projects. If the tax policies in Belarus, Poland, or other countries where we operate are changed, terminated, or not extended or comparable new tax incentives are not introduced, we expect that our operating expenses and/or our effective income tax rate could increase significantly, which could materially adversely affect our financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations - Provision for Income Taxes.”

In Belarus, one local subsidiary is a member, along with other technology companies, of High-Technologies Park. Members have a full exemption from Belarus income tax and value added tax until 2049 and are taxed at reduced amounts on obligatory social contributions and a variety of other taxes. If the tax policies in Belarus or other countries where we operate are changed, terminated, or not extended or comparable new tax incentives are not introduced, we expect that our operating expenses and/or our effective income tax rate could increase significantly, which could materially adversely affect our financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations - Provision for Income Taxes.”

Our ability to maintain continuing relationships with our major clients and successfully obtain payment for our services is essential to the growth and profitability of our business. However, the volume of work performed for any specific client is likely to vary from year to year, especially since we generally are not our clients’ exclusive IT services provider and we generally do not have long-term commitments from clients to purchase our services. We may also fail to assess the creditworthiness of our clients adequately or accurately. Our clients’ ability to terminate engagements with or without cause and our clients’ inability or unwillingness to pay for services we performed makes our future revenues and profitability uncertain. Although a substantial majority of our revenues are generated from clients who also contributed to our revenues during the prior year, our engagements with our clients are typically for projects that are singular in nature. Therefore, we must seek to obtain new engagements when our current engagements end. There are a number of factors relating to our clients that are outside of our control, which might lead them to terminate or not renew a contract or project with us, or be unable to pay us, including: •financial difficulties, including client insolvency or bankruptcy or increased global inflationary pressures and elevated interest rates; •corporate restructuring, mergers, and acquisitions; •our inability to complete our contractual commitments and invoice and collect our contracted revenues; •change in strategic priorities or economic conditions that eliminate the impetus for the project or reduce technology-related spending; •change in outsourcing strategy resulting in moving more work to the client’s in-house technology departments or to our competitors; and •replacement of existing software with packaged software supported by licensors. Termination, non-renewal, or renegotiation of a client contract or delayed starts to projects cause us to experience a higher-than-expected number of unassigned employees and thus compress our margins until we are able to reallocate our headcount. Clients that delay payment, request modified payment arrangements, or fail to meet their payment obligations increase our cash collection time, cause us to incur bad debt expense, and cause us to incur collection expenses. The loss of any of our major clients, a significant decrease in the volume of work they outsource to us or price they are willing or able to pay us, if not replaced by new service engagements and revenues, could materially adversely affect our revenues and results of operations.

Our ability to maintain continuing relationships with our major customers and successfully obtain payment for our services is essential to the growth and profitability of our business. However, the volume of work performed for any specific customer is likely to vary from year to year, especially since we generally are not our customers’ exclusive IT services provider and we generally do not have long-term commitments from customers to purchase our services. We may also fail to assess the creditworthiness of our customers adequately or accurately. Our customers’ ability to terminate engagements with or without cause and our customers’ inability or unwillingness to pay for services we performed makes our future revenues and profitability uncertain. Although a substantial majority of our revenues are generated from customers who also contributed to our revenues during the prior year, our engagements with our customers are typically for projects that are singular in nature. Therefore, we must seek to obtain new engagements when our current engagements end. There are a number of factors relating to our customers that are outside of our control, which might lead them to terminate or not renew a contract or project with us, or be unable to pay us, including: •financial difficulties, including customer insolvency or bankruptcy or increased global inflationary pressures and interest rates; •corporate restructuring, or mergers and acquisitions activity; •our inability to complete our contractual commitments and invoice and collect our contracted revenues; •change in strategic priorities or economic conditions, resulting in elimination of the impetus for the project or a reduced level of technology related spending; •change in outsourcing strategy resulting in moving more work to the customer’s in-house technology departments or to our competitors; and •replacement of existing software with packaged software supported by licensors. Termination, non-renewal, or renegotiation of a customer contract or delayed starts to projects could cause us to experience a higher-than-expected number of unassigned employees and thus compress our margins until we are able to reallocate our headcount. Customers that delay payment, request modifications to their payment arrangements, or fail to meet their payment obligations to us could increase our cash collection time, cause us to incur bad debt expense, or cause us to incur expenses in collections actions. The loss of any of our major customers, a significant decrease in the volume of work they outsource to us or price they are willing or able to pay us, if not replaced by new service engagements and revenues, could materially adversely affect our revenues and results of operations. 16 16 16 16 16 16 Table of Contents Table of Contents Table of Contents

The market for our services is highly competitive and we expect competition to persist and intensify, especially as we and our competitors develop generative AI capabilities and specialties. We face competition from offshore IT services providers in other outsourcing destinations with low wage costs, as well as competition from large, global consulting and outsourcing firms and in-house IT departments of large corporations. Clients tend to engage multiple IT services providers instead of using an exclusive IT services provider, which reduces our revenues and places downward pressure on pricing among competing IT services providers. Clients may prefer service providers that have more locations, more personnel, more experience in a particular country or market, or that are based in countries that are more cost-competitive or have the perception of being more stable than some of the emerging markets in which we operate. Some of our competitors have substantially greater financial, marketing or technical resources and we may be unable to retain our clients or successfully attract new clients. Increased competition, our inability to compete successfully, pricing pressures or loss of market share could have a material adverse effect on our business.

The market for our services is highly competitive, and we expect competition to persist and intensify. We face competition from offshore IT services providers in other outsourcing destinations with low wage costs, as well as competition from large, global consulting and outsourcing firms and in-house IT departments of large corporations. Customers tend to engage multiple IT services providers instead of using an exclusive IT services provider, which reduces our revenues and places downward pressure on pricing among competing IT services providers. Customers may prefer service providers that have more locations, more personnel, more experience in a particular country or market, or that are based in countries that are more cost-competitive or have the perception of being more stable than some of the emerging markets in which we operate. Some of our present and potential competitors have substantially greater financial, marketing or technical resources; therefore, we may be unable to retain our customers or successfully attract new customers. Increased competition, our inability to compete successfully, pricing pressures or loss of market share could have a material adverse effect on our business.

Wages for technology professionals in the emerging markets where we have significant operations and delivery centers are lower than comparable wages in more developed countries. However, wages in general, and in the technology industry in emerging markets in particular, have increased and will make us less competitive if we are not able to increase the efficiency and productivity of our people. Wage inflation, whether driven by competition for talent, ordinary course pay increases, or broader market forces, all increase our cost of providing services and reduce our profitability when we are not able to pass those costs on to our clients or adjust prices when justified by market demand. In addition, there are significant expenses associated with issuing stock-based compensation, and changes to our equity compensation practices and programs can affect our ability to attract and retain talent.

Wages for technology professionals in the emerging markets where we have significant operations and delivery centers are lower than comparable wages in more developed countries. However, wages in general, and in the technology industry in emerging markets in particular, have increased at a faster rate than in the past, which will make us less competitive if we are not able to increase the efficiency and productivity of our people. If we increase operations and hiring in more developed economies, our compensation expenses will increase because of the higher wages demanded in those markets. Wage inflation, whether driven by competition for talent, ordinary course pay increases, or broader market forces, all increase our cost of providing services and reduce our profitability when we are not able to pass those costs on to our customers or adjust prices when justified by market demand. We expect to continue granting equity-based awards under our stock incentive plans and paying other stock-based compensation. There are significant expenses associated with issuing stock-based compensation under our equity incentive plans, but if we reduce the amount or value of equity award grants, we may not be able to attract and retain key personnel. Conversely, if we grant more or higher value equity awards to attract and retain key personnel, our equity compensation expenses could materially adversely affect our results of operations. Regulations restricting equity compensation, volatility in our stock, and dilution to our stockholders diminishes our use and the value of equity-based awards and puts us at a competitive disadvantage or causes us to reconsider our compensation practices.

We have significant operations and personnel in Ukraine and Belarus. Ongoing conflict and disruption in the region following Russia’s invasion of Ukraine in February 2022 has had and could continue to have a material adverse effect on our operations, personnel, business, clients, service delivery, and financial results. In particular, as of December 31, 2024, approximately 13,950 of our global delivery, administrative and support personnel were based in Ukraine and Belarus, both of which are involved in or affected by Russia’s invasion of Ukraine. While a significant number of our employees from Belarus and from our former operations in Russia have relocated since the Russian invasion, we expect to continue operating in Ukraine, Belarus and in bordering Eastern Europe and Central Asia countries. All of these countries currently are, and in the future may be, adversely impacted by regional instability. Any escalation of the conflict that includes Belarus or its military could jeopardize our personnel, facilities, and operations in Belarus. In addition to a significant number of personnel and operations in Ukraine, we also own an office building in Kyiv and lease office space in a number of cities in Ukraine, all or some of which may be damaged or destroyed as a result of the continued attacks against Ukraine. The impact of any escalation on Ukraine, as well as responses by countries that provide military aid to Ukraine or institute sanctions against officials, individuals, institutions, companies, and industries in Belarus and in the annexed portions of Ukraine, and counter-responses taken by Russia and its allied countries has had and could continue to have a material adverse effect on our operations. In order to protect against potential cyberattacks or other information security threats, some of our clients have implemented steps to block internet communications with Ukraine and Belarus, which has had a material adverse effect on our ability to deliver our services from those locations to those clients. Our clients have sought and may continue to seek altered contract terms and delivery locations for the performance of services, delay planned work, seek services from competitors, or suspend, terminate, or reduce existing contracts or services, all of which could have a material adverse effect on our financial condition. The material adverse effects from the conflict and enhanced sanction and counter-sanctions activity have caused us to shift portions of our delivery capabilities to other countries and may continue to disrupt our delivery of services and restrict our ability to engage in certain projects or with certain clients. EPAM is actively monitoring and enhancing security related to our people and the stability of our infrastructure, including communications, physical assets, energy supplies, and internet availability. We execute our business continuity plans in response to developments as they occur and to protect and relocate our personnel and address impacts on our delivery infrastructure. To date we have not experienced any material interruptions in our infrastructure or the utility supply or internet connectivity we use to support our clients. We have no way to predict the progress or outcome of the war in Ukraine or its impacts in Belarus or the region because the conflict and government reactions are rapidly changing and beyond our control. If the military conflict, sanctions, and counter-sanctions in Ukraine, Belarus, and the surrounding region continue for the long-term or escalate, we could be required to further rebalance our geographic concentrations and it could have a material adverse effect on our personnel, operations, financial results and business outlook. 10 10 10 10 10 10 Table of Contents Table of Contents Table of Contents

We have significant operations and personnel in Ukraine and Belarus. Ongoing conflict and disruption in the region following Russia’s invasion of Ukraine in February 2022 has had and could continue to have a material adverse effect on our business, customers, service delivery, and financial results. Economic, civil, military, energy supply and political uncertainty exists and may increase in many of the regions where we operate and derive our revenues. In particular, as of December 31, 2023, approximately 12,600 of our global delivery, administrative and support personnel were based in Ukraine and Belarus, both of which are involved in or affected by Russia’s invasion of Ukraine. While a significant number of our employees from Belarus and from our former operations in Russia have relocated, and we expect more employees may relocate to our other delivery locations in the future, we expect to continue operating in Ukraine and Belarus and we also have significant operations in bordering countries and in countries allied with Russia in the nearby emerging market economies of Eastern Europe and Central Asia, which currently are, and in the future may be, adversely impacted by regional instability. In addition to a significant number of personnel and operations in Ukraine, we also own an office building in Kyiv and lease office space in a number of cities in Ukraine, all or some of which may be damaged or destroyed as a result of the continued attacks against Ukraine. Any escalation of the conflict that includes Belarus or its military could jeopardize our personnel, facilities, and operations in Belarus. The impact to Ukraine, as well as actions taken by other countries, including arms shipments and new and stricter sanctions by Canada, the United Kingdom, the European Union and its member countries, the U.S. and other countries and organizations against officials, individuals, regions, and industries in the annexed portions of Ukraine and Belarus, and responses to such shipments, sanctions, tensions, and military actions has had and could continue to have a material adverse effect on our operations. In order to protect against potential cyberattacks or other information security threats, some of our customers have implemented steps to block internet communications with Ukraine and Belarus, which has had a material adverse effect on our ability to deliver our services from those locations. Our customers have sought and may continue to seek altered terms, conditions, and delivery locations for the performance of services, delay planned work or seek services from alternate providers, or suspend, terminate, fail to renew, or reduce existing contracts or services, all of which could have a material adverse effect on our financial condition. The material adverse effects from the conflict, enhanced sanctions activity, and counter-sanctions may continue to disrupt our delivery of services, has caused us to shift portions of our work occurring in the region to other countries, and may continue to restrict our ability to engage in certain projects or with certain customers. EPAM is actively monitoring and enhancing the security of our people and the stability of our infrastructure, including communications, physical assets, energy supply, and internet availability. Our business continuity plans are designed to address known contingency scenarios to ensure that we have adequate processes and practices in place to protect the safety of our people and to handle anticipated impacts on our delivery capabilities. Our crisis management procedures, business continuity plans, and disaster recovery capabilities may not be effective at preventing or mitigating the effects of prolonged or multiple crises, such as civil unrest, military conflict, energy instability and a pandemic in a concentrated geographic area or in multiple geographies. We continue to execute our business continuity plans in response to developments as they occur and to protect the safety of our personnel and address potential impacts on our delivery infrastructure. To date we have not experienced any material interruptions in our infrastructure, utility supply or internet connectivity needed to support our customers. We implemented contingency plans to relocate work and/or personnel to other geographies within our global footprint and add new locations, as appropriate. Increased operations, service delivery, and hiring in existing or new geographies, including in more developed economies, has and is likely to continue to increase our expenses, especially compensation expenses for technology professionals in those markets, which could reduce the profitability of our business. 10 10 10 10 10 10 Table of Contents Table of Contents Table of Contents Events in the regions where we operate have and could continue to pose security risks to our people, our facilities, our operations, and our infrastructure, such as utilities and network services, and the further disruption of any or all of them could materially adversely affect our operations and financial results, cause additional volatility in the price of our stock, and reduce our profitability. We have no way to predict the progress or outcome of the war in Ukraine or its impacts in Belarus or the region because the conflict and government reactions are rapidly changing and beyond our control. Whether in these countries or in others in which we operate, prolonged civil unrest, political instability or uncertainty, military activities, broad-based sanctions or counter-sanctions, should they continue for the long-term or escalate, could require us to further rebalance our geographic concentrations and could have a material adverse effect on our personnel, operations, financial results and business outlook.