JKHY: 10-K Risk Factor Changes

Data security breaches, failures, or other incidents could damage our reputation and business. Our business relies upon receiving, processing, storing, and transmitting sensitive information relating to our operations, associates, and clients. If we fail to maintain a sufficient digital security infrastructure, address security vulnerabilities and new threats, or deploy adequate technologies to secure our systems against attack, we may be subject to security breaches that compromise confidential information, including valuable intellectual property, proprietary information, trade secrets, know-how, or source code, which could lead to their theft, misuse, unauthorized disclosure, or misappropriation. Cybersecurity incidents, which, among other things, may result in unauthorized access to systems, service interruptions, malicious intrusions, exfiltration of data, ransomware, cyber-attacks, or operating failures, have become more sophisticated and more prevalent, have occurred in our systems in the past, and may occur in our systems in the future. Such incidents could adversely affect our ability to operate our business, damage our reputation and business, adversely affect our results of operations and financial condition, and expose us to liability. We rely on third parties for various business purposes, and these third parties face similar security risks. A security failure by one of these third parties could expose our data or subject our information systems to interruption of operations and security vulnerabilities. Our information systems rely on hardware, software, and other technological elements, whether developed in-house or provided by third parties, that occasionally need to be patched or updated to address existing or potential security vulnerabilities. If these vulnerabilities are not remediated in a timely manner, our systems and data may be at risk of compromise or interruption.

Our services and infrastructure are heavily reliant on the internet. Computer networks and the internet are vulnerable to disruptive problems such as denial of service attacks or other cyber-attacks carried out by cyber criminals or state-sponsored actors. We are continually subject to attempts by unauthorized parties to access confidential information or to destroy data, often through the introduction of computer viruses, ransomware or malware, and cyber-attacks. The increasing sophistication of frontier artificial intelligence models is reshaping the cyber-attack landscape. The growing use of frontier AI models by unauthorized parties has changed the scale of cyber threats and speed and complexity of cyber-attacks, including automated phishing, deepfakes, the rapid development of new malware, and novel attack techniques targeting or leveraging AI systems and models. Further, the use of frontier AI allows these parties to identify and exploit software vulnerabilities faster and more broadly than ever before, including attacks targeting zero-day vulnerabilities that might not have been identified, or identified as quickly, without the use of frontier AI. The vulnerabilities targeted by these attacks are constantly evolving and can be difficult to identify, detect, prevent, or mitigate. We utilize technology, including artificial intelligence-enabled tools, to help defend against cybersecurity threats. However, threat actors are increasingly using similar technologies to identify vulnerabilities, automate attacks, and evade detection. If our security capabilities fail to keep pace with the evolving methods used by threat actors, our systems, data, operations, and reputation could be adversely affected. Those same parties may also attempt to fraudulently induce associates, clients, third-party service providers, or other authorized users of our systems through phishing schemes or other social engineering methods to disclose sensitive information to gain access to our data or that of our clients or their accountholders. We have experienced phishing attacks, social engineering attempts, and other cybersecurity incidents targeting our associates, clients, and systems. When successful, these coordinated attacks may result in data loss, exfiltration, and disruption to systems and services, and can damage our reputation as a secure financial technology company.

We are also subject to the risk that our associates may, unintentionally or with malicious intent, intercept and transmit unauthorized confidential or proprietary information or that corporate-owned devices used by associates are stolen, or client data media is lost in shipment. An interception, misuse, or mishandling of personal, confidential, or proprietary information being sent to or received from a client or third-party could result in legal liability, remediation costs, regulatory action, and reputational harm, any of which could adversely affect our results of operations and financial condition.

Like other financial institution service providers, we continually face third-party attempts to discover and exploit system weaknesses or to circumvent our security measures. We regularly experience attacks and other malicious activities targeting our systems, services, infrastructure, and data, as well as those of our clients, third-party service providers, and other vendors. These activities continue to increase in frequency and sophistication. Despite implementing security controls and infrastructure designed to protect our systems and data, we have experienced cybersecurity incidents in the past and may experience them in the future. We cannot be certain that our efforts will be sufficient to combat all current and future technological risks and threats. These risks are further heightened by

15

the fact that a significant portion of our associates and contractors work remotely outside of Company-controlled facilities using networks and devices that are not physically controlled by the Company, potentially limiting the effectiveness of our security controls. Advances in computer capabilities, breakthroughs in cryptography, the accelerating development, sophistication, and deployment of artificial intelligence technologies, or other technical developments could materially enhance the ability of threat actors to identify vulnerabilities, bypass controls, or otherwise compromise our systems, thereby rendering our security measures inadequate. Security risks may result in liability to our clients or other third parties, damage to our reputation, and may deter financial institutions from purchasing our products. The significant amount of capital and other resources we currently expend to protect against the threat of security breaches may prove insufficient to prevent a breach. We cannot ensure that any limitation-of-liability provisions in our client and user agreements, contracts with third-party service providers, or other contracts are sufficient to protect us from liabilities or damages with respect to claims relating to a security breach or similar matters. The insurance coverage we maintain to address data security risks may be insufficient to cover all types of claims or losses that may arise, and there is no assurance that such insurance coverage will continue to be available to us on economically reasonable terms, or at all. In the event of a security breach, we may need to spend substantial additional capital and resources alleviating problems caused by such breach. Under state, federal, and foreign laws, including those requiring consumer notification of security breaches, the costs to remediate security breaches can be substantial. Addressing security problems may result in interruptions, delays, or cessation of service to users, any of which could harm our business.

Failure to maintain sufficient technological infrastructure or an operational failure in our outsourcing facilities could expose us to damage claims, increase regulatory scrutiny, and cause us to lose clients. Our products and services require substantial investments in technological infrastructure, and we continue to grow in the number of users, transactions, and data that our technological infrastructure supports. If we fail to adequately invest in and support our technological infrastructure and processing capacity, we may not be able to support our clients’ processing needs and may be more susceptible to interruptions and delays in services. Damage or destruction that interrupts our outsourcing operations could cause delays and failures in processing which could hurt our relationship with clients, damage our reputation, expose us to damage claims, and cause us to incur substantial additional expenses to relocate operations and repair or replace damaged equipment. Events that could cause operational failures include, but are not limited to, hardware and software defects, breakdowns or malfunctions, cybersecurity incidents, human error, power losses, disruptions in telecommunications services, computer viruses or other malware, or other events. Our facilities are also subject to physical risks related to natural disasters or severe weather events, such as tornados, flooding, hurricanes, and heat waves. Climate change may increase the likelihood and severity of such events. Our back-up systems and procedures may prove insufficient or otherwise fail to prevent disruption, such as a prolonged interruption of our transaction processing services. If an interruption extends for more than several hours, we may experience data loss or a reduction in revenues due to such interruption. Any significant interruption of service could reduce revenue, harm our and our clients' reputations, result in damage claims, cause current and prospective clients to choose alternative service providers, and increase regulatory scrutiny of the critical services we provide to financial institutions, thereby increasing our compliance obligations and costs. Implementing modifications and upgrades to our technological infrastructure subjects us to inherent costs and risks associated with changing systems, policies, procedures, and monitoring tools.

16

Failures associated with payment transactions could result in financial loss. The volume and dollar amount of payment transactions that we process is significant and continues to grow. We direct the settlement of funds on behalf of financial institutions, other businesses, and consumers, and receive funds from clients, card issuers, payment networks, and consumers on a daily basis for a variety of transaction types. Transactions facilitated by us include debit card, credit card, electronic bill payment transactions, Automated Clearing House (“ACH”) payments, real-time payments through faster payment networks (such as Zelle, RTP, and FedNow), and check clearing that support consumers, financial institutions, and other businesses. Such services are critical to our clients’ operations. If the continuity of operations, the integrity of our processing systems, or our ability to detect or prevent fraudulent payments were compromised in connection with payments transactions, our clients’ operations could be disrupted or adversely affected. Any such disruption could result in financial losses, reputational damage, legal or regulatory consequences, and other adverse effects for both our clients and us. In addition, we rely on various third parties to process transactions and provide services in support of the processing of transactions and funds settlement for certain of our products and services that we cannot provide ourselves. If we are unable to obtain such services in the future or if the price of such services becomes unsustainable, our business, financial position, and results of operations could be materially and adversely affected. In addition, we may issue short-term credit to consumers, financial institutions, or other businesses as part of the funds settlement process. A default on this credit by a counterparty could result in a financial loss to us.

Failures of third-party service providers we rely upon could lead to financial loss. We rely on third-party service providers to support key portions of our operations. We also rely on third-party service providers to provide part, or all, of certain services we deliver to clients. As we continue to move more computing, storage, and processing services out of our data centers and facilities and into third-party hosting environments like public cloud infrastructure providers.as well as private cloud co-location facilities, our reliance on these providers and their systems will increase. The migration of our products and services to these new cloud-based systems is complex and requires substantial expenditures. Furthermore, we face risks inherent in the conversion to any new system, including potential data loss and operational disruptions. We rely on a limited number of third-party service providers that provide significant portions of our hosting and technology infrastructure. While we have selected these third-party service providers carefully and conduct ongoing diligence and monitoring, we do not control their actions or operations. Any disruption, capacity constraints, interference, failure, cybersecurity incident, service degradation, or other interruption of these services by a third-party service provider could result in degraded performance, data loss, or prolonged outages and adversely affect our operations and our ability to deliver services to clients. Such a failure could lead to damage claims, loss of clients, reputational harm, increased costs, contractual disputes, regulatory scrutiny, and, depending on the duration and severity of the failure, could have a material adverse effect on our business, financial condition, results of operations and cash flows. Third parties perform significant operational services on our behalf. These third-party service providers are subject to similar risks as us including, but not limited to, compliance with applicable laws and regulations, hardware and software defects, breakdowns or malfunctions, cybersecurity incidents, human error, failures in internal controls, power losses, disruptions in telecommunications services, computer viruses or other malware, natural disasters or severe weather events, or other events. One or more of our third-party service providers may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party service provider. Certain of our third-party service providers may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. If a critical third-party service provider is unable to meet our needs in a timely manner or if the services or products provided by such a third-party service provider are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products timely and cost-effectively, our clients could be negatively impacted, and it could have a material adverse effect on our business.

We operate in highly competitive and rapidly evolving markets and our business will be adversely affected if we fail to compete effectively. We vigorously compete with a variety of software vendors and service providers in all our major product lines. We compete on the basis of product quality, reliability, performance, ease of use, quality of support and services, integration with other products, and pricing. Some of our competitors may have advantages over us due to their size, product lines, greater marketing resources, or exclusive intellectual property rights. New competitors, including smaller start-ups, regularly appear with new products, services, and technology for financial institutions. We are also experiencing increasing competition from nontraditional market participants, including financial technology companies, payment-focused providers, and technology platforms that offer products, services, or alternative delivery models that compete with portions of our solutions. Certain competitors may be able to devote greater financial resources to innovation, respond more rapidly to changing client demands, or accept business and operating risks that differ from our approach. If competitors offer more favorable pricing, payment or other contractual terms, warranties, or functionality, or otherwise attract our clients or prevent us from capturing new clients, we may need to lower prices or offer other terms that negatively impact our results of operations in order to

17

successfully compete. Emerging technologies, evolving payment methods, and changing client preferences may alter how financial services products and services are delivered and consumed and could reduce demand for certain existing solutions or displace portions of traditional technology and payment processing models. If we are unable to adapt our products and services to these developments in a timely and cost-effective manner, our competitive position, revenues, growth prospects, and results of operations could be adversely affected. In addition, increased adoption of specialized point solutions may reduce demand for broader integrated offerings and result in the replacement of components of our existing product suite.

Failure to achieve favorable renewals of service contracts could negatively affect our business. Our contracts with our clients for outsourced data processing and electronic payment transaction processing services generally run for a period of six years. We will continue to experience a significant number of these contracts coming up for renewal each year. Renewal time presents our clients with the opportunity to consider other providers or to renegotiate their contracts with us, including reducing the services we provide or negotiating the prices paid for our services. Certain of our renewals have resulted in price compression between the former and renegotiated contracts. If that trend accelerates or becomes more pronounced, it could negatively impact our results of operations. If we are not successful in achieving high renewal rates upon favorable terms, revenues and profit margins will suffer. We may experience increased costs for services from our third-party service providers due to inflation or other cost expansion, but because our client contracts typically have longer terms than our third-party service provider contracts, our ability to pass on those higher costs to clients may be limited. If inflation or costs outpace our contractual ability to adjust pricing during the contractual terms of our client contracts, our revenues and profit margins could be negatively impacted.

If we fail to adapt our products and services to changes in technology and the markets we serve, we could lose existing clients and be unable to attract new business. The markets for our products and services are characterized by changing client and regulatory requirements and rapid technological changes. These factors and new product introductions by our existing competitors or by new market entrants could reduce the demand for our existing products and services, and we may be required to develop or acquire new products and services. In addition, competitors and other third parties may incorporate artificial intelligence into products and offerings more quickly or more successfully than we do, which could impair our ability to compete effectively and adversely affect our results of operations. Our future success is dependent on our ability to enhance our existing products and services in a timely manner and to develop or acquire new products and services. If we are unable to develop or acquire new products and services to address the needs of our clients, or if we fail to sell the new or enhanced products and services in which we have invested, we may incur unanticipated expenses or fail to achieve anticipated revenues, as well as lose prospective sales.

The increasing adoption of artificial intelligence (AI), machine learning (ML), and generative artificial intelligence into our products introduces significant and evolving risks that could lead to unintended consequences, result in reputational harm, and increased litigation. Our business currently utilizes AI and ML and we continue to evaluate and expand their use, including generative AI, to augment our products and services. While these technologies offer distinct business opportunities, they also bring evolving legal, regulatory, and operational risks. The regulatory landscape relating to these technologies is quickly and constantly evolving and requires significant resources to modify and maintain business practices to comply with applicable laws. Further, the ongoing tension between the states and the federal government regarding AI regulations is causing increased uncertainty and risk and compliance costs, particularly regarding the use of automated decision-making and other uses of AI technologies in high-risk industries, including the financial industry. This uncertainty has a broader impact than simply AI-targeted regulations and may expose us to claims of privacy rights violations or providing inadequate cybersecurity protections. From an operational standpoint, AI algorithms and training methodologies may create accuracy issues, unintended biases, factual errors, misrepresentations, offensive language, inappropriate statements, or other unexpected outcomes that could undermine product and service quality or lead to errors in our decision-making and solution development. Ineffective or inadequate AI development, testing, evaluation, deployment, content labeling, or governance may impair public acceptance or cause harm, resulting in offerings not working as intended, and we also face explainability risk from our potential inability to interpret or justify AI model decisions, which may lead to concerns about trust, regulatory compliance, and accountability. Furthermore, the uncertainty in the regulatory environment and our development and use of generative AI technologies expose us to evolving intellectual property risks, including the potential misuse of proprietary or confidential inputs, infringement of third-party rights, and uncertainty regarding the ownership of AI-generated outputs. Additionally, the use of AI tools by associates—whether authorized or not—for internal functions or business operations may result in unintended or unreliable outputs, which could negatively impact the quality, accuracy, or consistency of work product and decision-making. Our failure to accurately identify and address our responsibilities and liabilities in this new environment could negatively affect any solutions we develop incorporating such technology and could subject

18

us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. These same risks apply to our third-party service providers who are implementing these tools into the products or services they provide to us. Any failures to manage and mitigate these risks by these third-party service providers may negatively affect the products and services we provide our clients.

Software defects or problems with installations and updates may harm our business and reputation and expose us to potential liability. Our software products are complex and may contain undetected defects, especially in connection with newly released products and software updates. Software defects may cause interruptions or delays to our services as we attempt to correct the problem. We may also experience difficulties in installing or integrating our products on systems used by our clients. Defects in our software, installation problems or delays, or other difficulties could result in negative publicity, loss of revenues, loss of competitive position, or claims against us by clients. In addition, we rely on technologies and software supplied by third parties that may also contain undetected errors or defects that could have a negative effect on our business and results of operations. If patches or updates are not properly tested prior to installation, or are not properly installed, our systems and data may be at risk of compromise or interruption as a result of such failures.

Expansion of services to non-traditional clients could expose us to new risks. We have expanded our services to business lines that are marketed outside our traditional, regulated, and litigation-averse base of financial institution clients. These non-regulated clients may entail greater operational, credit, and litigation risks than we have faced before and could result in increases in bad debts and litigation costs.