RNG · Read the filing

ITEM 1A. RISK FACTORS

This Report contains forward-looking statements that are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks and uncertainties include, but are not limited to, the risk factors set forth below. The risks and uncertainties described in this Report are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently believe are immaterial may also affect our business. See the section entitled “Special Note Regarding Forward-Looking Statements” of this Annual Report on Form 10-K for a discussion of the forward-looking statements that are qualified by these risk factors. If any of these known or unknown risks or uncertainties actually occurs and have a material adverse effect on us, our business, financial condition and results of operations could be seriously harmed.

Summary Risk Factors

An investment in our Class A Common Stock involves a high degree of risk, and the following is a summary of key risk factors when considering an investment. This is only a summary. You should read this summary together with the more detailed description of each risk factor contained in the subheadings further below and other risks.

•We have incurred significant losses and negative cash flows in the past and anticipate continuing to incur losses for at least the foreseeable future, and we may therefore not be able to achieve or sustain profitability in the future.

•Our quarterly and annual results of operations have fluctuated in the past and may continue to do so in the future. As a result, we may fail to meet or to exceed the expectations of research analysts or investors, which could cause our stock price to fluctuate.

•We rely on third parties, including third parties in countries outside the U.S., primarily in Georgia and the Philippines for a significant portion of our software development, quality assurance, operations, and customer support.

•Global economic conditions may harm our industry, business and results of operations, including the effects of the ongoing war between Russia and Ukraine and related international sanctions against Russia, the ongoing war between Israel and Hamas, and relations between the United States and China.

•Our historically rapid growth and the quickly changing markets in which we operate make it difficult to evaluate our current business and future prospects, which may increase the risk of investing in our stock.

•Our future operating results will rely in part upon the successful execution of our relationships with our strategic partners and global service providers, including Avaya, Amazon, Atos, ALE, Mitel (Unify), Charter Communications, Vodafone, DT, Optus, and other partners and resellers, some or all of which may not be successful.

•We face intense competition in our markets and may lack sufficient financial or other resources to compete successfully.

•We rely and may in the future rely significantly on our strategic partners, agents, brokers, resellers, and global service providers to sell our subscriptions; our failure to effectively develop, manage, and maintain our indirect sales channels could materially and adversely affect our revenues.

•To deliver our subscriptions, we rely on third parties for our network connectivity and for certain of the features in our subscriptions.

•Interruptions or delays in service from our third-party data center hosting facilities, co-location facilities and other third-party providers could impair the delivery of our subscriptions, require us to issue credits or pay penalties and harm our business.

•Failures in Internet infrastructure or interference with broadband access could cause current or potential users to believe that our systems are unreliable, possibly leading our customers to switch to our competitors or to avoid using our subscriptions.

•A security incident, such as a cyber-attack, information security breach or denial of service event could delay or interrupt service to our customers, harm our reputation or business, impact our subscriptions, and subject us to significant liability.

Table of Contents

•We depend largely on the continued services of our senior management and other highly-skilled employees, and if we are unable to hire, retain, manage and motivate our employees, we may not be able to grow effectively and our business, results of operations and financial condition could be adversely affected.

•Increased customer turnover, or costs we incur to retain and upsell our customers, could materially and adversely affect our financial performance.

•If we are unable to attract new customers to our subscriptions or upsell to those customers on a cost-effective basis, our business will be materially and adversely affected.

•Our Credit Agreement imposes operating and financial restrictions on us.

•Servicing our debt, including the Notes, may require a significant amount of cash, and we may not have sufficient cash flow from our business to pay all of our indebtedness.

•The Senior Notes Indenture contains restrictive covenants that may limit our ability to engage in activities that may be in our long-term best interest.

•For as long as the dual class structure of our common stock as contained in our charter documents is in effect, voting control will be concentrated with a limited number of stockholders that held our stock prior to our initial public offering, including primarily our founders and their affiliates, and limiting other stockholders’ ability to influence corporate matters.

•Our Series A Convertible Preferred Stock has rights, preferences and privileges that are not held by, and are preferential to the rights of, our common stockholders, which could adversely affect our liquidity and financial condition.

Risks Related to Our Business and Our Industry

We have incurred significant losses and negative cash flows in the past and anticipate continuing to incur losses for at least the foreseeable future, and we may therefore not be able to achieve or sustain profitability in the future.

We have incurred substantial net losses since our inception. We have historically spent considerable amounts of time and money to develop new business communications solutions and enhanced versions of our existing business communications solutions to position us for future growth. Additionally, we have incurred substantial losses and expended significant resources upfront to market, promote and sell our solutions and expect to continue to do so in the future. We also expect to continue to invest for future growth, including for advertising, customer acquisition, technology infrastructure, storage capacity, services development and international expansion. In addition, as a public company, we incur significant accounting, legal, and other expenses.

We expect to continue to incur losses for at least the foreseeable future and will have to generate and sustain increased revenues to achieve future profitability. Achieving profitability will require us to increase revenues, manage our cost structure, and avoid significant liabilities. Revenue growth has slowed and in the future, revenues may decline, or we may incur significant losses in the future for a number of possible reasons, including general macroeconomic conditions, increasing competition (including competitive pricing pressures), a decrease in customer demand or the growth of the markets in which we compete, in particular the UCaaS, CCaaS and SaaS markets, or if we fail for any reason to continue to capitalize on growth opportunities. Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays, service delivery, and quality problems and other unknown factors that may result in losses in future periods, such as our previous write-down charges relating to our strategic partnership with Avaya. If these losses exceed our expectations or our revenue growth expectations are not met in future periods, our financial performance will be harmed and our stock price could be volatile or decline.

Our quarterly and annual results of operations have fluctuated in the past and may continue to do so in the future. As a result, we may fail to meet or to exceed the expectations of research analysts or investors, which could cause our stock price to fluctuate.

Our quarterly and annual results of operations have varied historically from period to period, and we expect that they will continue to fluctuate due to a variety of factors, many of which are outside of our control, including:

•our ability to expand and retain existing customers, resellers, partners, and global service providers, and expand our existing customers’ user base, and attract new customers;

Table of Contents

•our ability to realize the benefits of our existing strategic partnerships and other strategic relationships that we may enter into in the future;

•our ability to introduce new solutions, including both solutions that we develop or license, and solutions we purchase for resale from third parties;

•the actions of our competitors, including pricing changes or the introduction of new solutions;

•our ability to effectively manage our growth;

•our ability to successfully penetrate the market for larger businesses;

•our ability to upsell our customers to our existing and new products and services;

•our ability to limit and manage downsell and churn;

•our dependency on third-party vendors of hardware, software and services that we resell to our customers;

•the mix of monthly, annual and multi-year subscriptions at any given time;

•the timing, cost, and effectiveness of our advertising and marketing efforts;

•the timing, operating cost, and capital expenditures related to the operation, maintenance and expansion of our business;

•our ability to successfully and timely execute on, integrate, and realize the benefits of any acquisition, investment, strategic partnership, or other strategic transaction or partnership we may make or undertake;

•service outages or actual or perceived information security breaches or incidents and any related impact on our reputation;

•our ability to accurately forecast revenues and appropriately plan our expenses;

•our ability to realize our deferred tax assets;

•costs associated with defending and resolving intellectual property infringement and other claims;

•changes in tax laws, regulations, or accounting rules;

•the retention of our senior management and other key employees, their ability to execute on our business plan and the loss of services of senior management or other key employees, whether in the past or in the future;

•the timing and cost of developing or acquiring technologies, services or businesses, and our ability to successfully manage any such acquisitions;

•our ability to execute our operating plans successfully while reducing costs and optimizing operating margin;

•our ability to generate and grow our non-GAAP adjusted, unlevered free cash flow;

•the impact of foreign currencies on our business as we continue to expand our business internationally; and

•the impact of worldwide economic, political, industry, and market conditions, including the effects of the ongoing war between Russia and Ukraine and related international sanctions against Russia, the ongoing war between Israel and Hamas, and U.S.-China relations.

Any one of the factors above, or the cumulative effect of some or all of the factors referred to above, may result in significant fluctuations in our quarterly and annual results of operations. This variability and unpredictability could result in our failure to meet our publicly announced guidance or the expectations of securities analysts or investors for any period, which could cause our stock price to decline. In addition, a significant percentage of our operating expenses is fixed in nature and is based on forecasted revenues trends. Accordingly, in the event of revenue shortfalls, we may not be able to mitigate the negative impact on net income (loss) and margins in the short term. If we fail to meet or exceed the expectations of research analysts or investors, the market price of our shares could fall substantially, and we could face costly lawsuits, including securities class-action suits.

We rely on third parties, including third parties in countries outside the U.S., primarily in Georgia and the Philippines for a significant portion of our software development, quality assurance, operations, and customer support.

We currently depend on various third parties for some of our software development efforts, quality assurance, operations, and customer support services, including third parties in countries outside the U.S. Specifically, we have outsourced

Table of Contents

some of our software development and design, quality assurance, and operations activities to third-party contractors that have employees and consultants in Tbilisi, Georgia. In addition, we outsource a portion of our customer support, inside sales, network operation control functions, and general and administrative activities to third-party contractors located in Manila, the Philippines. Our dependence on third-party contractors, including those in countries outside the U.S., creates a number of risks, in particular, the risk that we may not maintain service quality, control, or effective management with respect to these business operations.

We also rely on purchased or leased hardware and software licensed from third parties in order to offer our subscriptions, and in some cases, we integrate third-party licensed software components into our platform. Any errors or defects in third-party hardware or software could result in errors or a failure of our subscriptions which could harm our business.

We anticipate that we will continue to depend on our third-party relationships in order to grow our business for the foreseeable future. If we are unsuccessful in maintaining existing and, if needed, establishing new relationships with third parties, our ability to efficiently operate existing services or develop new services and provide adequate customer support could be impaired, and, as a result, our competitive position or our results of operations could suffer.

A portion of our software development, quality assurance, and network operations workforce is located in Ukraine and Israel, where there are armed conflicts.

In the past, we depended on third-party partners in Russia and Ukraine for software development, quality assurance and operations. Following Russia’s invasion of Ukraine, our former third-party partner in Russia ceased its operations and a substantial proportion of its affected personnel relocated to other countries such as Georgia, Spain, and Bulgaria. We are working with our third-party contractor in Ukraine and in Georgia to relocate their personnel to Spain, Bulgaria, and other countries; and we have had to further relocate and in the future may need to relocate some of these personnel to still other countries; however, we cannot assure you that we can permanently relocate them in a cost effective manner, or at all. In addition, we have discontinued our partner operations in Ukraine, which has disrupted our development efforts and our release of new features. We have incurred, and may in the future further incur, increased costs associated with managing or assisting in relocating our partners’ personnel or engaging with alternative third-party contractors or hiring employees outside of Russia and Ukraine, which could negatively impact our operating results and financial condition.

We also have engineering operations located in Israel, which continues to be affected by the war between Israel and Hamas. This ongoing and evolving conflict, as well as the war between Russia and Ukraine, could create or heighten global security concerns, increase the risk of cyber-attacks, and have a lasting impact on regional and global economies, all of which could have a material adverse effect on our business, financial condition and results of operations.

Global economic conditions may harm our industry, business and results of operations, including the effects of the ongoing war between Russia and Ukraine and related international sanctions against Russia, the ongoing war between Israel and Hamas, and relations between the United States and China.

We operate globally and, as a result, our business, revenues and profitability are impacted by global macroeconomic conditions. The success of our activities is affected by general economic and market conditions, including, among others, inflation rate fluctuations, interest rates, supply chain constraints, lower consumer confidence, volatile equity capital markets, tax rates, economic uncertainty, political instability, changes in laws, instability in the banking and financial system, and trade barriers and sanctions. Recently, inflation and interest rates in the U.S. have risen to levels not seen in several years, which has increased and may continue to increase our operating costs. In addition, such economic volatility could adversely affect our business, financial condition, results of operations and cash flows, and future market disruptions could negatively impact us. Further, any U.S. federal government shutdown resulting from failing to pass budget appropriations, adopt continuing funding resolutions, and other budgetary decisions limiting or delaying government spending, may negatively impact U.S. or global economic conditions, including corporate and consumer spending, and liquidity of capital markets. Unfavorable economic conditions could increase our operating costs and, because our typical contracts with customers lock in our price for a few years such that we are generally unable to make corresponding increases in contract pricing, our profitability could be negatively affected. Geopolitical destabilization could impact global currency exchange rates, supply chains, trade and movement of resources, the price of commodities such as energy, as well as demand for our products and services, which may adversely affect the technology spending of our customers and potential customers. Geopolitical conflicts, including the effects of the ongoing war between Russia and Ukraine and related international sanctions against Russia, the ongoing war between Israel and Hamas, and U.S.-China relations, are heightening these risks.

Table of Contents

Some of our international agreements provide for payment denominated in local currencies, and the majority of our local costs are denominated in local currencies. Fluctuations in the value of the U.S. dollar versus foreign currencies may impact our operating results when translated into U.S. dollars. Thus, our results of operations and cash flows are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Euro, British Pound Sterling, Bulgarian Lev, Chinese Yuan, Indian Rupee, and Canadian Dollar, and may be adversely affected in the future due to changes in foreign currency exchange rates. While we have limited currency exchange exposure to the Georgian, Israeli, and Philippine currencies, we expect exchange rates with respect to these and other currencies to continue to be more volatile than previously normal as a result of the ongoing armed conflict in Israel and other regions. Certain changes in exchange rates have and may continue to negatively affect our revenues, expenses, and other operating results as expressed in U.S. dollars in the future.

Our historically rapid growth and the quickly changing markets in which we operate make it difficult to evaluate our current business and future prospects, which may increase the risk of investing in our stock.

We have grown rapidly since 2009, when we introduced RingCentral MVP, our flagship product. We have encountered and expect to continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly changing markets. If our assumptions regarding these uncertainties are incorrect or change in reaction to changes in our markets, or if we do not manage or address these risks successfully, our results of operations could differ materially from our expectations, and our business could suffer.

Growth may place significant demands on our management and our infrastructure.

We continue to experience growth in our business. This growth has placed and may continue to place significant demands on our management, organizational structure, and our operational and financial infrastructure, particularly as we try to become more profitable and financially and operationally efficient. As our operations grow in size, scope, and complexity, we may need to increase our sales and marketing efforts and may add additional sales and marketing personnel in various regions worldwide and improve and upgrade our systems and infrastructure to attract, service, and retain an increasing number of customers. For example, we expect the volume of simultaneous calls to increase significantly as our customer base grows. Our network hardware and software may not be able to accommodate this additional simultaneous call volume. The expansion of our systems and infrastructure could require us to commit substantial financial, operational, and technical resources in advance of an increase in the volume of business, with no assurance that the volume of business will increase. Any such additional capital investments will increase our cost base.

Continued growth could also strain our ability to maintain reliable service levels for our customers, resellers, partners, and global service providers, develop and improve our operational, financial and management controls, enhance our billing and reporting systems and procedures, and recruit, train and retain highly skilled personnel. In addition, our existing systems, processes, and controls may not prevent or detect all errors, omissions, or fraud. We may also experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software licensed to help us with such improvements. Any future growth, particularly further international expansion and the transition to a multi-product company, could add complexity to our organization, require effective communication and coordination throughout our organization, and result in additional costs. For example, such expansion may require us to set up regional and country governance models to manage our operations in certain countries, which may result in incremental general and administrative expenses. To manage any future growth effectively, we must continue to improve and expand our information technology and financial, operating, security and administrative systems and controls, and our business continuity and disaster recovery plans and processes. Additionally, our productivity and the quality of our solutions and services may be adversely affected if we do not integrate and train our new employees quickly and effectively. If we fail to achieve the necessary level of efficiency in our organization as we grow, our business, results of operations and financial condition could be materially and adversely affected.

Our future operating results will rely in part upon the successful execution of our relationships with our strategic partners and global service providers, including Avaya, Amazon, Atos, ALE, Mitel (Unify), Charter Communications, Vodafone, DT, Optus, and other partners and resellers, some or all of which may not be successful.

A strategic partnership between two independent businesses is a complex, costly, and time-consuming process that requires significant management attention and resources. Realizing the benefits of our partnerships, particularly our relationships with our strategic partners and global service providers, including Avaya, Atos, ALE, Mitel (Unify), Charter Communications, Vodafone, DT, and Optus, will depend on a variety of factors, including our ability to work with our strategic partners to develop, market and sell our MVP and co-branded solutions, such as Avaya Cloud Office by RingCentral (“ACO”), and our other offerings. Setting up and maintaining the operations and processes of these strategic relationships may cause us to

Table of Contents

incur significant costs and disrupt our business. The failure to successfully, effectively, and timely implement and operate our strategic relationships could harm our ability to realize the anticipated benefits of one or more of these partnerships and could adversely affect our results of operations. In addition, our ability to successfully operate our strategic partnerships relies on partner performance, which can be affected by financial conditions, insolvency, corporate restructures, divestiture, changes in management, changes in control, and other changes affecting our partners’ business operations. For example, Mitel recently announced that it has completed the acquisition of Unify from Atos. We expect to continue our partnership with Unify as part of Mitel. Although we do not expect this acquisition to impact our partner programs, we cannot assure you that this would be the case.

We face intense competition in our markets and may lack sufficient financial or other resources to compete successfully.

The cloud-based business communications and collaboration solutions industry is competitive, and we expect competition to increase in the future. We face intense competition from other providers of business communications and collaboration systems and solutions.

Our competitors include traditional on-premises, hardware business communications providers such as ALE, Avaya, Cisco Systems, Mitel, NEC Corporation, Siemens Enterprise Networks, LLC, their resellers, agents and others, as well as companies such as Microsoft Corporation and Cisco Systems, Inc., and their resellers that license their software. In addition, certain of our global service providers and strategic partners, such as AT&T, BT, TELUS, Vodafone, DT, Amazon, Avaya, Atos, ALE, and Mitel (Unify) market and sell our solutions, but they are also competitors for business communications services, selling and marketing their own solutions as well as, in some cases, other third-party solutions. Some of these companies may have significantly greater resources than us and currently, or may in the future, develop and/or host their own solutions through the cloud. Such competitors may not be successful in or cease marketing and selling our solutions to their customers and may ultimately be able to transition some or all of those customers onto their competing solutions, which could materially and adversely affect our revenues and growth. We also face competition from other companies and established communications providers that resell on-premises hardware, software, cloud and hosted solutions, such as 8x8, Inc., Amazon.com, Inc., Dialpad, Inc., LogMeIn, Inc, Microsoft Corporation, Nextiva, Inc., Twilio Inc., Vonage Holdings Corp., and Zoom Video Communications, Inc., which has introduced a voice solution. Established communications providers, such as AT&T, Verizon Communications Inc., T-Mobile, and Comcast Corporation in the U.S., TELUS and others in Canada, Telefonica Spain, DT, and BT, Vodafone Group plc, and others in the U.K., that resell on-premises hardware, software, and hosted solutions, compete with us in business communications and currently, or may in the future, develop and/or host their own cloud solutions. We may also face competition from other large Internet companies, such as Alphabet Inc. (Google Voice), Meta Platforms, Inc., Oracle Corporation, and Salesforce.com, Inc., any of which might launch its own cloud-based business communications services or acquire other cloud-based business communications companies in the future. We also compete against providers of communications platform as a service solutions and messaging software platforms with APIs such as Twilio Inc., and Slack Technologies, Inc. (acquired by Salesforce, Inc.), on which customers can build diverse solutions by integrating cloud communications into business applications. We face competition with respect to this solution from contact center and customer relationship management providers such as Amazon.com, Inc., Avaya, Five9, Inc., NICE InContact (including LiveVox Holdings, Inc.), Genesys Telecommunications Laboratories, Inc., Talkdesk, Inc., Vonage Holdings Corp., Salesforce.com, Inc., and Twilio Inc. We also face competition from digital engagement vendors such as eGain Corporation, LivePerson, Inc., among others named above that may offer similar features.

Many of our current and potential competitors have longer operating histories, significantly greater resources and name recognition, more diversified offerings, international presence, and larger customer bases than we have. As a result, these competitors may have greater credibility with our existing and potential customers and may be better able to withstand an extended period of downward pricing pressure. In addition, certain of our competitors have partnered with, or been acquired by, and may in the future partner with or acquire, other competitors to offer services, leveraging their collective competitive positions, which makes it more difficult to compete with them and could significantly and adversely affect our results of operations. Demand for our platform is also sensitive to price. Many factors, including our marketing, user acquisition and technology costs, and our current and future competitors’ pricing and marketing strategies, can significantly affect our pricing strategies. Our competitors may be able to adopt more aggressive pricing policies and promotions and devote greater resources to the development, promotion and sale of their services than we can to ours. Some of these service providers have in the past and may choose in the future to sacrifice revenues in order to gain market share by offering their services at lower prices or for free, or offering alternative pricing models, such as “freemium” pricing, in which a basic offering is provided for free with advanced features provided for a fee, on the services they offer. Our competitors may also offer bundled service arrangements offering a more complete service offering, despite the technical merits or advantages of our subscriptions. Competition could result in a decrease to our prices, slow our growth, increase our customer turnover, reduce our sales, or decrease our market share.

Table of Contents

We rely and may in the future rely significantly on our strategic partners, agents, brokers, resellers, and global service providers to sell our subscriptions; our failure to effectively develop, manage, and maintain our indirect sales channels could materially and adversely affect our revenues.

Our future success depends on our continued ability to establish and maintain a network of channel relationships. A substantial portion of our revenues is derived from our network of sales agents, brokers, and resellers, which we refer to collectively as channel partners, many of which sell or may in the future decide to sell their own business communications services or business communications services from other providers. Governmental regulators and contractual restrictions with telecom carriers may also restrict the ability of our channel partners and resellers to resell our products and services in some countries. We generally do not have long-term contracts with these channel partners, and the loss of or reduction in sales through these third parties could materially reduce our revenues. Our competitors may in some cases be effective in causing our current or potential channel partners to favor their services or prevent or reduce sales of our subscriptions. Furthermore, while some of our strategic partners and global service providers, such as AT&T, BT, TELUS, Vodafone, DT, Avaya, Atos, ALE, and Mitel (Unify) also sell and market our solutions on an exclusive or non-exclusive basis, they may also sell and market competing business communications. Some of these companies have significantly greater resources than us and currently, or may in the future, develop and/or host their own or third-party cloud solutions. Such competitors may cease marketing or selling our solutions to their customers and may ultimately be able to transition some or all of those customers onto their competing solutions, which could materially and adversely affect our revenues and growth.

We have also entered into certain agreements with our strategic partners and global service providers to sell and market certain of our solutions. However, there can be no guarantee that our strategic partners, global service providers and/or any of their respective channel partners will be successful in marketing or selling our solutions or that they will not cease marketing or selling our solutions in the future. In addition, from time to time, we have had disagreements with certain of our strategic partners. Further, certain partners have failed in the past, and may fail in the future, to meet their minimum contractual seat and/or revenue commitments, including recoupment of advance payments. The Company has in the past, and may in the future, renegotiate the terms of its strategic partnership agreements, including converting strategic partners from exclusive to non-exclusive partners.

In addition, we are in the process of transforming generally our channel partner go-to-market strategy, with increasing enablement of a resale/wholesale model, which requires significant changes to our systems and processes. These system and process changes could result in longer time to implement our strategy which could have an impact on our revenue.

If our strategic partners and global service providers and/or any of their respective channel partners are not successful in marketing and selling our solutions or cease to market and sell our solutions, our revenues and growth could be significantly and adversely affected. If we fail to maintain relationships with our channel partners, global service providers and strategic partners or fail to develop new and expanded relationships in existing or new markets, or if our networks of indirect channel relationships are not successful in their sales efforts, sales of our subscriptions may decrease and our operating results would suffer. In addition, we may not be successful in managing, training, and providing appropriate incentives to our existing resellers and other channel partners, global service providers and strategic partners, and they may not be able to commit adequate resources in order to successfully sell our solutions.

To deliver our subscriptions, we rely on third parties for our network connectivity and for certain of the features in our subscriptions.

We currently use the infrastructure of third-party network service providers, including Lumen Technologies, Inc. and Bandwidth.com, Inc. in North America and several others internationally, to deliver our subscriptions over their networks. Our third-party network service providers provide access to their Internet protocol (“IP”) networks and public switched telephone networks, and provide call termination and origination services, including 911 emergency calling in the U.S. and equivalent services internationally, and local number portability for our customers. We expect that we will continue to rely heavily on third-party network service providers to provide these subscriptions for the foreseeable future.

Through our wholly-owned local exchange carrier subsidiary, RCLEC, Inc. (“RCLEC”), we also obtain certain connectivity and network services directly from incumbent local exchange carriers (“ILECS”) and from other competitive local exchange carriers (“CLECs”) in certain geographic markets at lower prices than we pay for such services through third-party network service providers. However, RCLEC also uses the infrastructure of third-party network service providers to deliver its services and the ILECs may favor themselves and their affiliates and may not provide network services to us at lower prices than we could obtain through third-party CLECs, or at all. If we are unable to continue to reduce our pricing as a result of obtaining network services through our subsidiary, we may be forced to rely on other third-party network service providers and

Table of Contents

be unable to effectively lower our cost of service. Historically, our reliance on third-party networks has reduced our operating flexibility and ability to make timely service changes and control quality of service, and we expect that this will continue for the foreseeable future. If any of these network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis or at reasonable levels of quality and security, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to another third-party network service provider, if one is available, could have a material adverse effect on our business and results of operations.

In addition, we currently use and may in the future continue to use third-party service providers to deliver certain features of our subscriptions. For example, although we introduced our own video and web conferencing solution in April 2020 and have migrated many of our customers to RingCentral Video, there are still several existing customers who continue to use Zoom Video Communications, Inc. for HD video and web conferencing and screen sharing features, Bandwidth.com for texting capabilities, and NICE inContact, Inc. for contact center capabilities. In the future, we may not continue to have long-term contracts with any or all of these third-party providers. In the same way, our customers may from time to time require that we resell them third-party software, hardware and services that we do not regularly offer. Therefore, in some instances, we are required to obtain these software, hardware and services from third-party providers. Any of these service providers could elect or attempt to stop providing us with access to their services or our contracts with these third-party providers may terminate, expire, or be breached. If any of these service providers ceases to provide us with their services, fails to provide these services to us on a cost-effective basis or at reasonable levels of quality and security, ceases operations, or otherwise terminates or discontinues these services, the delay caused by qualifying and switching to another third-party service provider, if one is available, or building a proprietary replacement solution could have a material adverse effect on our business and results of operations. Furthermore, we are no longer offering or selling RingCentral Meetings to new customers and are instead offering our own RingCentral Video solution, and, in light of our settlement with Zoom, we believe that we will be able to migrate all or substantially all of our customers to RingCentral Video. Nevertheless, it is possible that not all existing customers will migrate to RingCentral Video. Therefore, our inability to offer and sell RingCentral Meetings, or to successfully transfer existing customers to our own solution, may cause some prospective customers not to purchase our services and/or existing customers not to renew their contracts for our services or to renew for a fewer number of seats.

Relatedly, U.S. mobile carriers are now requiring businesses using SMS on over-the-top providers, including all Communications Platform as a Service (“CPaaS”) and UCaaS providers, such as RingCentral, to register with The Campaign Registry (“TCR”), to ensure text messages are compliant with wireless carrier guidelines, as well as to reduce spam. These new rules affect our customers, and we have built integrations with TCR to facilitate those registrations for our customers. TCR registration and related vetting can be cumbersome and costly and may cause customer churn, especially for SMB customers that have more limited person-to-person SMS needs. In the future, customers who are not registered with TCR may not be able to send or receive SMS using our service. Additionally, SMS aggregators and wireless carriers sometimes block legitimate SMS traffic without prior notice, which may negatively impact our customers.

Finally, if problems occur with any of these third-party network or service providers, it may cause errors or poor call quality in our subscriptions, and we could encounter difficulty identifying the source of the problem. The occurrence of errors or poor call quality in our subscriptions, whether caused by our systems or a third-party network or service provider, may result in the loss of our existing customers, delay or loss of market acceptance of our subscriptions, termination of our relationships and agreements with our channel partners, strategic partners, or global service providers, or liability for failure to meet service level agreements which may require us to issue service credits or pay damages, and may seriously harm our business and results of operations.

We rely on third-party software that may be difficult to replace or which could cause errors or failures of our subscriptions.

We rely on software licensed from certain third parties in order to offer our solutions. In some cases, we integrate third-party licensed software components into our platform. This software may not continue to be available at reasonable prices or on commercially reasonable terms, or at all. Any loss of the right to use any of this software could significantly increase our expenses and otherwise result in delays in the provisioning of our solutions until equivalent technology is either developed by us, or, if available, is identified, obtained, and integrated. Any errors or defects in third-party software could result in errors or a failure of our solutions, which could harm our business.

Table of Contents

Interruptions or delays in service from our third-party data center hosting facilities, co-location facilities and other third-party providers could impair the delivery of our subscriptions, require us to issue credits or pay penalties and harm our business.

We currently serve our North American customers from geographically disparate data center hosting facilities in North America, where we lease space from Equinix, Inc., and other providers, and we serve our European customers from third-party data center hosting facilities in Europe. We also use third-party co-location facilities located in various international regions to serve our customers in these regions. Certain of our solutions are hosted by third-party data center facilities including Amazon Web Services, Inc. (“AWS”), NICE inContact, Inc., and Google Cloud Platform. In addition, RCLEC uses third-party co-location facilities to provide us with network services at several locations. Damage to, or failure of, these facilities, the communications network providers with whom we or they contract, or with the systems by which our communications providers allocate capacity among their customers, including us, or software errors, have in the past and could in the future result in interruptions in our services. Additionally, in connection with the addition of new data centers or expansion or consolidation of our existing data center facilities, we may move or transfer our data and our customers’ data to other data centers. Despite precautions that we take during this process, any unsuccessful data transfers may impair or cause disruptions in the delivery of our subscriptions. Interruptions in our subscriptions may reduce our revenues, may require us to issue credits or pay penalties, subject us to claims and litigation, cause customers to terminate their subscriptions and adversely affect our renewal rates and our ability to attract new and retain existing customers. Our ability to attract and retain customers depends on our ability to provide customers with a highly reliable subscription and even minor interruptions in our subscriptions could harm our brand and reputation and have a material adverse effect on our business.

As part of our current disaster recovery arrangements, our North American and European infrastructure and our North American and European customers’ data is currently replicated in near real-time at data center facilities in the U.S. and Europe, respectively. We do not control the operation of these facilities or of our other data center facilities or RCLEC’s co-location facilities, and they are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, and similar events. They may also be subject to human error or to break-ins, sabotage, acts of vandalism, and similar misconduct.

Despite precautions taken at these facilities, the occurrence of a natural disaster, public health crisis or pandemic, human error, cybersecurity incident, including ransomware or denial-of-service attack, an act of terrorism or other unanticipated problems at these facilities could result in lengthy interruptions in our subscriptions. Even with the disaster recovery arrangements in place, our subscriptions could be interrupted.

We may also be required to transfer our servers to new data center facilities in the event that we are unable to renew our leases on acceptable terms, if at all, or the owners of the facilities decide to close their facilities, and we may incur significant costs and possible subscription interruption in connection with doing so. In addition, any financial difficulties, such as bankruptcy or foreclosure, faced by our third-party data center operators, or any of the service providers with which we or they contract may have negative effects on our business, the nature and extent of which are difficult to predict. Additionally, if our data centers are unable to keep up with our increasing needs for capacity, our ability to grow our business could be materially and adversely impacted.

Failures in Internet infrastructure or interference with broadband access could cause current or potential users to believe that our systems are unreliable, possibly leading our customers to switch to our competitors or to avoid using our subscriptions.

Unlike traditional communications services, our subscriptions depend on our customers’ high-speed broadband access to the Internet. Increasing numbers of users and increasing bandwidth requirements may degrade the performance of our services and applications due to capacity constraints and other Internet infrastructure limitations. As our customer base grows and their usage of our services increases, we will be required to make additional investments in network capacity to maintain adequate data transmission speeds, the availability of which may be limited, or the cost of which may be on terms unacceptable to us. If adequate capacity is not available to us as our customers’ usage increases, our network may be unable to achieve or maintain sufficiently high reliability or performance. In addition, if Internet access service providers have outages or deteriorations in their quality of service, our customers will not have access to our subscriptions or may experience a decrease in the quality of our services. Frequent or persistent interruptions could cause current or potential users to believe that our systems or services are unreliable, leading them to switch to our competitors or to avoid our subscriptions, and could permanently harm our reputation and brands.

In addition, users who access our subscriptions and applications through mobile devices, such as smartphones and tablets, must have a high-speed connection, such as Wi-Fi®, 4G, 5G, or LTE, to use our services and applications. Currently,

Table of Contents

this access is provided by companies that have significant and increasing market power in the broadband and Internet access marketplace, including incumbent phone companies, cable companies, and wireless companies. Some of these providers offer solutions and subscriptions that directly compete with our own offerings, which can potentially give them a competitive advantage. Also, these providers could take measures that degrade, disrupt or increase the cost of user access to third-party services, including our offerings, by restricting or prohibiting the use of their infrastructure to support or facilitate third-party services or by charging increased fees to third parties or the users of third-party services, any of which would make our subscriptions less attractive to users, and reduce our revenues.

Interruptions in our services caused by undetected errors, failures, or bugs in our services could harm our reputation, result in significant costs to us, and impair our ability to sell our subscriptions.

Our services may have errors or defects that customers identify after they begin using them that could result in unanticipated interruptions of service. Internet-based services frequently contain undetected errors and bugs when first introduced or when new versions or enhancements are released. While the substantial majority of our customers are small and medium-sized businesses, the use of our services in complicated, large-scale network environments may increase our exposure to undetected errors, failures, or bugs in our services. Although we test our services to detect and correct errors and defects before their general release, we have, from time to time, experienced significant interruptions in our services as a result of such errors or defects and may experience future interruptions of service if we fail to detect and correct these errors and defects. The costs incurred in correcting such defects or errors may be substantial and could harm our results of operations. In addition, we rely on hardware purchased or leased and software licensed from third parties to offer our services.

Any defects in, or unavailability of, our or third-party software or hardware that cause interruptions of our services could, among other things:

•cause a reduction in revenues or a delay in market acceptance of our services;

•require us to pay penalties or issue credits or refunds to our customers, channel partners, strategic partners, or global service providers, or expose us to claims for damages;

•cause us to lose existing customers and make it more difficult to attract new customers;

•divert our development resources or require us to make extensive changes to our software, which would increase our expenses and slow innovation;

•increase our technical support costs; and

•harm our reputation and brand.

A security incident, such as a cyber-attack, information security breach or denial of service event could delay or interrupt service to our customers, harm our reputation or business, impact our subscriptions, and subject us to significant liability.

Our operations depend on our ability to protect our production and corporate information technology services from interruption or damage from cyber-attacks, denial-of-service events, unauthorized entry, insider threats, rogue employees or contractors, computer malware or other security incidents, including events beyond our control. Although we require our employees to undertake privacy and cybersecurity training, we have from time to time, been subject to communications fraud and cyber-attacks by malicious actors, and denial of service events, and we may be subject to similar attacks in the future, particularly as the frequency and sophistication of cyber-attacks increases. For example, an increase in cyber-attack activity, such as ransomware and phishing attacks, has been observed in connection with of the war between Russia and Ukraine. We cannot assure you that our backup systems, regular data backups, security controls and other procedures currently in place, or that may be in place in the future, will be adequate to prevent significant damage, system failure, service outages, data breach, data loss, unauthorized access, loss of use, interruption, or increased charges from our technology vendors.

Table of Contents

Also, our services are web-based. The amount of data we store for our customers and users increases as our business grows. We host services, which includes hosting customer data, both in co-located data centers and in multiple public cloud services. Our solutions allow users to store files, tasks, calendar events, messages and other data indefinitely on our services or as may be directed by our customers, although we have begun instituting in our customer agreements a provision that customer content and certain other customer data will be deleted upon termination of the agreements. We also maintain sensitive data related to our technology and business, and that of our employees, strategic partners, global service providers, channel partners, and customers, including intellectual property, proprietary business information and personally identifiable information (also called personal data) on our own systems and in multiple vendors’ cloud services. As a result of maintaining larger volumes of data and user files and/or as a result of our continued movement up market, or movement into new customer segments and acquisition of larger and more recognized customers, we may become more of a target for hackers, nation states and other malicious actors.

In addition, we use third-party vendors who, in some cases, have access to our data and our employees’, partners’, and customers’ data. We employ layered security measures and have a means of working with third parties who report vulnerabilities to us. Despite the implementation of security measures by us or our vendors, our computing devices, infrastructure, or networks, or our vendors’ computing devices, infrastructure, or networks have in the past, and may in the future, be vulnerable to hackers, computer viruses, worms, ransomware, other malicious software programs, employee theft or misuse, phishing, denial-of-service attacks, or similar disruptive problems that are caused by or through a security weakness or vulnerability in our or our vendors’ infrastructure, network, or business practices or our or our vendors’ customers, employees, business partners, consultants, or other Internet users who attempt to invade our or our vendors’ corporate and personal computers, tablets, mobile devices, software, data networks, or voice networks. Security weaknesses or vulnerabilities in our, our vendors’, or our customers’ infrastructure, networks, or business practices that are successfully targeted could lead to increased costs, liability claims, including contractual liability claims relating to security obligations in agreements with our partners and our customers, fines, claims, investigations and other proceedings, reduced revenue, or harm to our reputation or competitive position. In addition, even if not targeted, in strengthening our security controls or in remediating security vulnerabilities, we could incur increased costs and capital expenditures.

We have implemented remote working protocols and offer work-issued devices to certain employees, but the actions of employees while working remotely may have a greater effect on the security of our infrastructure, networks, and the information, including personally identifiable information, we process, including for example by increasing the risk of compromise to systems or data arising from employees’ combined personal and private use of devices, accessing our networks or information using wireless networks that we do not control, or the ability to transmit or store company-controlled information outside of our secured network. Although many of these risks are not unique to the remote working environment, they have been heightened by the dramatic increase in the numbers of our employees who have been and are continuing to work from home since the onset of the COVID-19 pandemic. We also allow a substantial number of our employees that are designated “remote” who primarily work from home, and “hybrid” who work from home several days per quarter, although we may change our work from home/return-to-office policy in the future. Our employees’ or third parties’ intentional, unintentional, or inadvertent actions may increase our vulnerability or expose us to security threats, such as ransomware, other malware and phishing attacks, and we may remain responsible for unauthorized access to, loss, alteration, destruction, acquisition, disclosure or other processing of information we or our vendors, business partners, or consultants process or otherwise maintain, even if the security measures used to protect such information comply with applicable laws, regulations and other actual or asserted obligations. Additionally, due to political uncertainty and military actions and related activities associated with the war between Russia and Ukraine and the war between Israel and Hamas, we and our vendors, business partners, and consultants are vulnerable to heightened risks of cyber-attacks from nation-state actors or their affiliated entities, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. Also, cyber-attacks, including on the supply chain (including our software supply chain), continue to increase in frequency and magnitude, and we cannot provide assurances that our preventative efforts, or those of our suppliers, will be successful.

We rely on encryption and authentication technology to ensure secure transmission of and access to confidential information, including customer credit card numbers, debit card numbers, direct debit information, customer communications, and files uploaded by our customers. Advances in computer capabilities, new discoveries in the field of cryptography, discovery of software bugs or vulnerabilities, discovery of hardware bugs or vulnerabilities, social engineering activities, or other developments may result in a compromise or breach of the technology we use to protect our data and our customer data, or of the data itself. We also have incorporated AI-powered features into our solutions and may continue to incorporate additional AI features and technologies into our solutions in the future. Our use of AI features and technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

Table of Contents

Additionally, third parties have attempted in the past, and may attempt in the future, to induce domestic and international employees, consultants, or customers into disclosing sensitive information, such as usernames, provisioning data, customer proprietary network information (“CPNI”) or other information in order to gain access to our customers’ user accounts or data, or to our data. CPNI includes information such as the phone numbers called by a customer, the frequency, duration, and timing of such calls, and any services purchased by the consumer, such as call waiting, call forwarding, and caller ID, in addition to other information that may appear on a customer’s bill. Third parties may also attempt to induce employees, consultants, or customers into disclosing information regarding our and our customers’ intellectual property, personal data and other confidential business information. In addition, the techniques used to obtain unauthorized access, to perform hacking, phishing and social engineering, or to sabotage systems change and evolve frequently and may not be recognized until launched against a target, may be new and previously unknown or little-known, or may not be detected or understood until well after such actions are conducted. We may be unable to anticipate these techniques or to implement adequate preventative measures, and any security breach or other incident may take longer than expected to remediate or otherwise address. Any system failure or security breach or incident that causes interruptions or data loss in our operations or in the computer systems of our customers or leads to the misappropriation of our or our customers’ confidential or personal information could result in significant liability to us, loss of our intellectual property, cause our subscriptions to be perceived as not being secure, cause considerable harm to us and our reputation (including requiring notification to customers, regulators, or the media), and deter current and potential customers from using our subscriptions. Any of these events could have a material adverse effect on our business, results of operations, and financial condition.

It is critical to our business that our sensitive information and that of our employees’, strategic partners’, global service providers’, channel partners’ and customers’ remains secure and that our customers perceive that this information is secure. An information security incident could result in unauthorized access to, loss of, or unauthorized disclosure of such information. A cybersecurity breach or incident could expose us to litigation, indemnity obligations, government investigations, contractual liability, and other possible liabilities. Additionally, a cyber-attack or other information security incident, whether actual or perceived, could result in negative publicity, which could harm our reputation and reduce our customers’ confidence in the effectiveness of our solutions, which could materially and adversely affect our business and operating results. A breach of our security systems could also expose us to increased costs, including remediation costs, disruption of operations, or increased cybersecurity protection costs, that may have a material adverse effect on our business. In addition, a cybersecurity breach or incident of our customers’ systems can also result in exposure of their authentication credentials, unauthorized access to their accounts, exposure of their account information and data (including CPNI), and fraudulent calls on their accounts, which can subsequently have similar actual or perceived impacts to us as described above. A cybersecurity breach or incident of our partners’ or vendors’ systems can result in similar actual or perceived impacts.

While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred by privacy or security incidents. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that an insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

Laws, regulations, and enforcement actions relating to security and privacy of information continue to evolve. For example, with respect to security, the SEC recently adopted cybersecurity risk management and disclosure rules, which require the disclosure of information pertaining to cybersecurity incidents and cybersecurity risk management, strategy, and governance. Additionally, we are closely monitoring the development of rules and guidance that may apply to us, including, for example, pursuant to the Cyber Incident Reporting for Critical Infrastructure Act of 2022. We have incurred and expect to continue to incur significant expenses to prevent security incidents. Determining whether a cybersecurity incident is notifiable or reportable may not be straightforward and may be costly and could lead to negative publicity, loss of customer or partner confidence in the effectiveness of our security measures, diversion of management’s attention, governmental investigations, and the expenditure of significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach. It is possible that, in order to support changes to applicable laws and to support our expansion of sales into new geographic areas or into new industry segments, we will need to change or enhance our cybersecurity systems, which may make it more expensive to operate in certain jurisdictions and may also increase the risk of our non-compliance with such changing laws and regulations.

Table of Contents

Potential problems with our information systems could interfere with our business and operations.

We rely on our information systems and those of third parties for processing customer orders, distribution of our subscriptions, billing our customers, processing credit card transactions, customer relationship management, supporting financial planning and analysis, accounting functions and financial statement preparation, and otherwise running our business. Information systems may experience interruptions, including interruptions of related services from third-party providers, which may be beyond our control. Such business interruptions could cause us to fail to meet customer requirements. All information systems, both internal and external, are potentially vulnerable to damage or interruption from a variety of sources, including without limitation, computer viruses, security breaches and incidents, energy blackouts, natural disasters, terrorism, war, telecommunication failures, employee or other theft, and third-party provider failures. In addition, since telecommunications billing is inherently complex and requires highly sophisticated information systems to administer, our internally developed billing system may experience errors or we may improperly operate the system, which could result in the system incorrectly calculating the fees owed by our customers for our subscriptions or related taxes and administrative fees. Any such errors in our customer billing could harm our reputation and cause us to violate truth in billing laws and regulations. Our current internally developed billing system requires us to process an increasing number of invoices manually, which could result in billing errors. Any errors or disruption in our information systems and those of the third parties upon which we rely could have a significant impact on our business. In addition, we may implement further and enhanced information systems in the future to meet the demands resulting from our growth and to provide additional capabilities and functionality. The implementation of new systems and enhancements is frequently disruptive to the underlying business of an enterprise, and can be time-consuming and expensive, increase management responsibilities, and divert management attention.

We depend largely on the continued services of our senior management and other highly-skilled employees, and if we are unable to hire, retain, manage and motivate our employees, we may not be able to grow effectively and our business, results of operations and financial condition could be adversely affected.

Our future performance depends on the continued services and contributions of our senior management and other key employees to execute on our business plan, and to identify and pursue opportunities and services innovations. The loss of services of senior management or other key employees, whether in the past or in the future, could significantly delay or prevent the achievement of our business, financial, developmental and strategic objectives. In particular, we depend to a considerable degree on the vision, skills, experience, and effort of our co-founder, Chairman and Chief Executive Officer, Vladimir Shmunis, who has provided our strategic direction for over 20 years and has built and maintained what we believe is an attractive workplace culture. Mr. Shmunis previously stepped down from his role as Chairman and Chief Executive Officer and transitioned to Executive Chairman of the company during the third quarter of 2023. In the fourth quarter of 2023, he returned to his role as Chairman and Chief Executive Officer. Any future changes resulting from the hiring or departure of executives, could disrupt our business and could impact our ability to preserve our culture, which could negatively affect our ability to recruit and retain personnel. None of our executive officers or other senior management personnel is bound by a written employment agreement and any of them may therefore terminate employment with us at any time with no advance notice. The replacement of any current or future senior management personnel could involve significant time and costs, and any such loss could significantly delay or prevent the achievement of our business objectives.

Our future success also depends on our ability to continue to attract and retain highly skilled personnel. Despite many recent layoffs in the technology industry and at the company, we believe that there is, and will continue to be, intense competition for highly skilled technical and other personnel with experience in our industry in the San Francisco Bay Area, where our headquarters is located, in Denver, Colorado, where a significant portion of our U.S. sales and customer support office and our network operations center is located, and in other locations where we maintain offices, and in some or all of the other locations where we have employees. In addition, changes to U.S. immigration policies, particularly to H-1B and other visa programs, and restrictions on travel could restrain the flow of technical and professional talent into the U.S. and may inhibit our ability to hire qualified personnel. Similar risks exist with respect to immigration regulations in other countries where we operate, may operate in the future or have employees or contractors. We must provide competitive compensation packages and a high-quality work environment to hire, retain, and motivate employees. If we are unable to retain and motivate our existing employees and attract qualified personnel to fill key positions, we may be unable to manage our business effectively, including the development, marketing, and sale of existing and new subscriptions, which could have a material adverse effect on our business, financial condition, and results of operations. To the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information. Volatility in, or lack of performance of, our stock price may also affect our ability to attract and retain key personnel.

Table of Contents

Increased customer turnover, or costs we incur to retain and upsell our customers, could materially and adversely affect our financial performance.

Although we have entered into long-term subscription contracts with larger customers, those customers with month to month contracts with us may terminate their subscriptions at any time without penalty or early termination charges. We cannot accurately predict the rate of customer terminations or average monthly subscription cancellations or failures to renew, which we refer to as turnover. Our customers with subscription agreements have no obligation to renew their subscriptions for our service after the expiration of their initial subscription period, which is typically between one and three years. In the event that these customers do renew their subscriptions, they may choose to renew for fewer users, shorter contract lengths, or for a less expensive subscription plan or edition. We cannot predict the renewal rates or types for customers that have entered into subscription contracts with us.

Customer turnover, as well as reductions in the number of users or pricing tier(s) for which a customer subscribes, each could have a significant impact on our results of operations, as does the cost we incur in our efforts to retain our customers and encourage them to upgrade their subscriptions and increase their number of users. Our turnover rate could increase in the future if customers are not satisfied with our services, including third-party services and products that we integrate or sell as separate items to our customers, the value proposition of our services, the customer support we provide, or our ability to otherwise meet their needs and expectations. Turnover and reductions in the number of users for whom a customer subscribes may also increase due to factors beyond our control, including the failure or unwillingness of customers to pay their monthly subscription fees due to financial constraints and the impact of a slowing economy. In addition, the impact of the global economic conditions, including concerns about heightened inflation and an associated economic downturn, and instability in the banking and financial system, could cause financial hardship for our customers, decrease technology spending, materially and negatively impact our customers’ willingness to enter into or renew subscriptions with us, cause our customers to seek a decrease in the number of users or solutions for which they subscribe, or impact our ability to collect in a timely manner monies due from the customer. For example, to address customer hardships, we may work with customers to provide greater flexibility to manage challenges they are facing, but we cannot be assured that they will not reduce their number of users or terminate their subscriptions altogether. Due to turnover and reductions in the number of users for whom a customer subscribes, we must acquire new customers, or acquire new users within our existing customer base, on an ongoing basis simply to maintain our existing level of customers and revenues. If a significant number of customers terminate, reduce, or fail to renew their subscriptions, or do not pay their subscription fees, we may be required to incur significantly higher marketing and/or sales expenditures than we currently anticipate in order to increase the number of new customers or to upsell existing customers, and such additional marketing and/or sales expenditures could harm our business and results of operations.

Our future success also depends in part on our ability to sell additional subscriptions and additional functionalities to our current customers. Any increase in the costs necessary to upgrade, expand and retain existing customers could materially and adversely affect our financial performance. If our efforts to convince customers to add users and, in the future, to purchase additional functionalities are not successful, our business may suffer. In addition, such increased costs could cause us to increase our subscription rates, which could increase our turnover rate.

If we are unable to attract new customers to our subscriptions or upsell to those customers on a cost-effective basis, our business will be materially and adversely affected.

In order to grow our business, we must continue to attract new customers, retain existing customers, and expand the number of users in, and services provided to, our existing customer base on a cost-effective basis. We use and periodically adjust the mix of advertising and marketing programs to promote our services. Significant increases in the pricing of one or more of our advertising channels would increase our advertising costs or may cause us to choose less expensive and perhaps less effective channels to promote our services. As we add to or change the mix of our advertising and marketing strategies, we may need to expand into channels with significantly higher costs than our current programs, which could materially and adversely affect our results of operations. In addition, a global slowdown of economic activity may disrupt our sales channels and our ability to attract new customers, which may require us to adjust our advertising and marketing programs or make further investments in these programs. We will incur advertising and marketing expenses in advance of when we anticipate recognizing any revenues generated by such expenses, and we may fail to otherwise experience an increase in revenues or brand awareness as a result of such expenditures. We have made in the past, and may make in the future, significant expenditures and investments in new advertising campaigns, and we cannot assure you that any such investments will lead to the cost-effective acquisition of additional customers. If we are unable to maintain effective advertising programs, our ability to attract new customers could be materially and adversely affected, our advertising and marketing expenses could increase substantially, and our results of operations may suffer.

Table of Contents

Some of our potential customers learn about us through leading search engines, such as Google, Yahoo!, and Microsoft Bing. While we employ search engine optimization and search engine marketing strategies, our ability to maintain and increase the number of visitors directed to our website is not entirely within our control. If search engine companies modify their search algorithms in a manner that reduces the prominence of our listing, or if our competitors’ search engine optimization efforts are more successful than ours, or if search engine companies restrict or prohibit us from using their services, fewer potential customers may click through to our website. In addition, the cost of purchased listings has increased in the past and may increase in the future. A decrease in website traffic or an increase in search costs could materially and adversely affect our customer acquisition efforts and our results of operations.

A significant portion of our revenues today come from small and medium-sized businesses, which may have fewer financial resources to weather an economic downturn.

A significant portion of our revenues today come from small and medium-sized businesses. These customers may be materially and adversely affected by economic downturns to a greater extent than larger, more established businesses. These businesses typically have more limited financial resources, including capital-borrowing capacity, than larger entities. Any economic downturn could decrease technology spending and the number of employees of small and medium sized businesses in ways that adversely affect demand for our offerings, could increase churn or down-sell and harm our business and results of operations. As the majority of our customers pay for our subscriptions through credit and debit cards, weakness in certain segments of the credit markets and in the U.S. and global economies has resulted in and may in the future result in increased numbers of rejected credit and debit card payments, which could materially affect our business by increasing customer cancellations and impacting our ability to engage new small and medium-sized customers. If small and medium-sized businesses experience financial hardship as a result of a weak economy, industry consolidation or for any other reason, the overall demand for our subscriptions could be materially and adversely affected.

We face significant risks in our strategy to target medium-sized and larger businesses for sales of our subscriptions and, if we do not manage these efforts effectively, our business and results of operations could be materially and adversely affected.

As we continue to target more of our sales efforts to medium-sized and larger businesses, we expect to incur higher costs and longer sales cycles and we may be less effective at predicting when we will complete these sales. In these market segments, the decision to purchase our subscriptions generally requires the approval of more technical personnel and management levels within a potential customer’s organization, and therefore, these types of sales require us to invest more time educating these potential customers about the benefits of our subscriptions. In addition, larger customers may demand more features, integration services, customization, more complex contract negotiations, and may require highly skilled sales and support personnel. Our investment in marketing our subscriptions to these potential customers may not be successful, which could significantly and adversely affect our results of operations and our overall ability to grow our customer base. Furthermore, many medium-sized and larger businesses that we target for sales may already purchase business communications solutions from our larger competitors or, due to economic conditions or otherwise, reduce their technology spending or reduce the number of new employees for whom they purchase our solutions or reduce the number of existing employees using our solution (i.e., down-sell). As a result of these factors, these sales opportunities may require us to devote greater research and development resources and sales support to individual customers, and invest in hiring and retaining highly skilled personnel, resulting in increased costs and could likely lengthen our typical sales cycle, which could strain our sales and support resources. Moreover, these larger transactions may require us to delay recognizing the associated revenues we derive from these customers until any technical or implementation requirements have been met.

Support for smartphones and tablets are an integral part of our solutions. If we are unable to develop robust mobile applications that operate on mobile platforms that our customers use, our business and results of operations could be materially and adversely affected.

Our solutions allow our customers to use and manage our cloud-based business communications solution on smart devices. As new smart devices and operating systems are released, we may encounter difficulties supporting these devices and services, and we may need to devote significant resources to the creation, support, and maintenance of our mobile applications. In addition, if we experience difficulties in the future integrating our mobile applications into smart devices or if problems arise with our relationships with providers of mobile operating systems, such as those of Apple Inc. or Alphabet Inc., our future growth and our results of operations could suffer.

Table of Contents

If we are unable to develop, license, or acquire new services or applications on a timely and cost-effective basis, our business, financial condition, and results of operations may be materially and adversely affected.

The cloud-based business communications industry is characterized by rapid development of and changes in customer requirements, frequent introductions of new and enhanced services, and continuing and rapid technological advancement. We cannot predict the effect of technological changes or the introduction of new, disruptive technologies on our business, and the market for cloud-based business communications may develop more slowly than we anticipate, or develop in a manner different than we expect, and our solutions could fail to achieve market acceptance. Our continued growth depends on continued use of voice and video communications by businesses, as compared to email and other data-based methods, and future demand for and adoption of Internet voice and video communications systems and services. In addition, to compete successfully, we must anticipate and adapt to technological changes and evolving industry standards, and continue to design, develop, manufacture, and sell new and enhanced services that provide increasingly higher levels of performance and reliability. As we develop, acquire, and introduce new services and technologies, including those that incorporate AI and machine learning, such as RingSense, we may be subject to new or heightened legal, ethical, and other challenges. Currently, we derive a majority of our revenues from subscriptions to RingCentral MVP, and we expect this will continue for the foreseeable future. However, our future success may also depend on our ability to introduce and sell new services, features, and functionality that enhance or are beyond the subscriptions we currently offer, as well as to improve usability and support and increase customer satisfaction. Our failure to develop solutions that satisfy customer preferences in a timely and cost-effective manner may harm our ability to renew our subscriptions with existing customers and create or increase demand for our subscriptions and may materially and adversely impact our results of operations.

The introduction of new services by competitors or the development of entirely new technologies to replace existing offerings could make our solutions outdated, obsolete or adversely affect our business and results of operations. Announcements of future releases and new services and technologies by our competitors or us could cause customers to defer purchases of our existing subscriptions, which also could have a material adverse effect on our business, financial condition or results of operations. We may experience difficulties with software development, operations, design, or marketing that could delay or prevent our development, introduction, or implementation of new or enhanced services and applications. We have in the past experienced delays in the planned release dates of new features and upgrades and have discovered defects in new services and applications after their introduction. We cannot assure you that new features or upgrades will be released according to schedule, or that, when released, they will not contain defects or bugs. Either of these situations could result in adverse publicity, loss of revenues, delay in market acceptance, or claims by customers brought against us, all of which could harm our reputation, business, results of operations, and financial condition. Moreover, the development of new or enhanced services or applications may require substantial investment, and we must continue to invest a significant amount of resources in our research and development efforts to develop these services and applications to remain competitive. We do not know whether these investments will be successful. If customers do not widely adopt any new or enhanced services and applications, we may not be able to realize a return on our investment. If we are unable to develop, license, or acquire new or enhanced services and applications on a timely and cost-effective basis, or if such new or enhanced services and applications do not achieve market acceptance, our business, financial condition, and results of operations may be materially and adversely affected.

The AI technology and features incorporated into our solutions include new and evolving technologies that may present both legal and business risks.

We have incorporated a number of AI-powered features, including RingSense, into our solutions and are making investments in expanding our AI capabilities. AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving legal and regulatory landscape. The successful integration of new and emerging AI technologies, such as generative AI, automated speech recognition (ASR), text-to-speech (TTS) and natural language processing (NLP) into our platforms and solutions will require additional investment, and the development of new approaches and processes, which will be costly and increase our expenses.

Further, the incorporation of AI-powered features into our solutions will subject us to new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns, or other complications that could harm our business, reputation, financial condition or results of operations. Intellectual property ownership and license rights, including copyright, surrounding AI technologies have not been fully addressed by federal or state laws or by U.S. courts, and the manner in which we configure and use AI technologies may expose us to claims of copyright infringement or other intellectual property misappropriation. It is possible that new laws and regulations will be adopted in the United States and in other countries, or that existing laws and regulations will be interpreted in ways that would affect the operation of our solution and the way in which we use AI. In addition, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could harm our business, reputation, financial condition and results of operations.

Table of Contents

Relatedly, large language models, or LLMs, can generate written content which contains bias, factual errors, misrepresentations, offensive language, or inappropriate statements. While we attempt to use LLMs in a way that mitigates these risks, there is no guarantee that we will be successful and these risks could harm our business, reputation, financial condition and results of operations.

In addition, the use of AI involves significant technical complexity and requires specialized expertise, and competition for specialized personnel in the AI industry is intense. Any disruption or failure in our AI systems or infrastructure could result in delays or errors in our operations, which could harm our business, reputation, financial condition and results of operations.

The use of AI by our workforce may present risks to our business.

Our workforce is exposed to and uses AI technologies for certain tasks related to our business. We have guidelines and policies specifically directed at the use of AI tools in the workplace. Nevertheless, the use of these AI tools, whether authorized or unauthorized, by our workforce, poses potential risks relating to the protection of data, including cybersecurity risk, exposure of our proprietary confidential information to unauthorized recipients, and the misuse of our or third-party intellectual property. Use of AI technology by our workforce, even when used consistent with our guidelines, may result in allegations or claims against us related to violation of third-party intellectual property rights, unauthorized access to or use of proprietary information, and failure to comply with open source software requirements. In addition, our employees use AI tools for various design and engineering tasks such as writing code and building content, and these AI technology tools may produce inaccurate responses that could lead to errors in our decision-making, solution development or other business activities, which could have a negative impact on our business, operating results and financial condition. Our ability to mitigate these risks will depend on our continued effective training, monitoring and enforcement of appropriate policies, guidelines and procedures governing the use of AI technology, and compliance by our workforce.

If we fail to continue to develop our brand or our reputation is harmed, our business may suffer.

We believe that continuing to strengthen our current brand will be critical to achieving widespread acceptance of our subscriptions and will require continued focus on active marketing efforts. The demand for and cost of online and traditional advertising have been increasing and may continue to increase. Accordingly, we may need to increase our investment in, and devote greater resources to, advertising, marketing, and other efforts to create and maintain brand loyalty among users. Brand promotion activities may not yield increased revenues, and even if they do, any increased revenues may not offset the expenses incurred in building our brand. In addition, if we do not handle customer complaints effectively, our brand and reputation may suffer, we may lose our customers’ confidence, and they may choose to terminate, reduce or not to renew their subscriptions. Many of our customers also participate in social media and online blogs about Internet-based software solutions, including our subscriptions, and our success depends in part on our ability to minimize negative and generate positive customer feedback through such online channels where existing and potential customers seek and share information. If we fail to sufficiently invest in, promote and maintain our brand, our business could be materially and adversely affected.

If we experience excessive fraudulent activity or cannot meet evolving credit card association merchant standards, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly.

Most of our customers authorize us to bill their credit card accounts directly for service fees that we charge. If customers pay for our subscriptions with stolen credit cards, we could incur substantial third-party vendor costs for which we may not be reimbursed. Further, our customers provide us with credit card billing information online or over the phone, and we do not review the physical credit cards used in these transactions, which increases our risk of exposure to fraudulent activity. We also incur charges, which are referred to in the industry as chargebacks, from the credit card companies from claims that a customer did not authorize the specific credit card transaction to purchase our subscription. If the number of chargebacks becomes excessive, we could be assessed substantial fines or be charged higher transaction fees, and we could lose the right to accept credit cards for payment. In addition, credit card issuers may change merchant and/or service provider standards, including data protection standards, required to utilize their services from time to time. We have established and implemented measures intended to comply with the Payment Card Industry Data Security Standard (“PCI DSS”). If we fail to maintain compliance with such standards or fail to meet new standards, the credit card associations could fine us or terminate their agreements with us, and we would be unable to accept credit cards as payment for our subscriptions. If we fail to maintain compliance with current service provider standards, such as PCI DSS, or fail to meet new standards, customers may choose not to use our services for certain types of communication they have with their customers. If such a failure to comply with relevant standards occurs, we may also face legal liability if we are found to not comply with applicable laws that incorporate, by

Table of Contents

reference or by adoption of substantially similar provisions, merchant or service provider standards, including PCI DSS. Our subscriptions may also be subject to fraudulent usage, including but not limited to revenue share fraud, domestic traffic pumping, subscription fraud, premium text message scams, and other fraudulent schemes. This usage can result in, among other things, substantial bills from our vendors, for which we would be responsible, for terminating fraudulent call traffic. In addition, third parties may have attempted in the past, and may attempt in the future, to induce employees, sub-contractors, or consultants into disclosing customer credentials and other account information, which can result in unauthorized access to customer accounts and customer data, unauthorized use of customers’ services, charges to customers for fraudulent usage and costs that we must pay to global service providers. Although we implement multiple fraud prevention and detection controls, we cannot assure you that these controls will be adequate to protect against fraud. Substantial losses due to fraud or our inability to accept credit card payments could cause our paid customer base to significantly decrease, which would have a material adverse effect on our results of operations, financial condition, and ability to grow our business.

We are in the process of expanding our international operations, which exposes us to significant risks.

We have significant operations directly or through third parties in many countries including the U.S., Canada, the U.K., China, the Philippines, Germany, Georgia, Bulgaria, Spain, Australia, India, and France. We also sell our solutions to customers in several countries in Europe, as well as in Australia, India and Singapore, and we may continue to grow our international presence in the future. The future success of our business will depend, in part, on our ability to expand our operations and customer base worldwide. Operating in international markets requires significant resources and management attention and will subject us to regulatory, economic, and political risks that are different from those in the U.S. Due to our limited experience with international operations and developing and managing sales and distribution channels in international markets, our international expansion efforts may not be successful. In addition, we will face risks in doing business internationally that could materially and adversely affect our business, including:

•our ability to comply with differing and evolving technical and environmental standards, telecommunications regulations, and certification requirements outside the U.S.;

•difficulties and costs associated with staffing and managing foreign operations;

•our ability to effectively price our subscriptions in competitive international markets;

•potentially greater difficulty collecting accounts receivable and longer payment cycles;

•the need to adapt and localize our subscriptions for specific countries;

•the need to offer customer care, product information, websites, and other marketing collateral in various native languages;

•the need to contract and bill in various native languages, currencies, and under a variety of different legal systems;

•reliance on third parties over which we have limited control, including those that market and resell our subscriptions;

•availability of reliable broadband connectivity and wide area networks in targeted areas for expansion;

•lower levels of adoption of credit or debit card usage for Internet related purchases by foreign customers and compliance with various foreign regulations related to credit or debit card processing and data protection requirements;

•difficulties in understanding and complying with local laws, regulations, and customs in foreign jurisdictions, including with respect to foreign labor laws and regulations, which may adversely affect our ability to manage our headcount and cost of our foreign work force;

•restrictions on travel to or from countries in which we operate or inability to access certain areas;

•export controls and economic sanctions; changes in diplomatic and trade relationships, including tariffs and other non-tariff barriers, such as quotas and local content rules;

•U.S. government and applicable foreign trade restrictions, including those which may impose restrictions, including prohibitions, on the exportation, re-exportation, sale, shipment or other transfer of programming, technology, components, and/or services to foreign persons;

Table of Contents

•our ability to comply with different and evolving laws, rules, and regulations, including the European General Data Protection Regulation (the “GDPR”) and other data privacy and data protection laws, rules and regulations;

•compliance with various anti-bribery and anti-corruption laws such as the Foreign Corrupt Practices Act and U.K. Bribery Act of 2010;

•more limited protection for intellectual property rights in some countries;

•adverse tax consequences;

•fluctuations in currency exchange rates;

•exchange control regulations, which might restrict or prohibit our conversion of other currencies into U.S. dollars;

•restrictions on the transfer of funds;

•new and different sources of competition;

•natural disasters or global health crises, such as the COVID-19 pandemic;

•political and economic instability created by the war between Russia and Ukraine and the war between Israel and Hamas;

•deterioration of political relations between the U.S. and other countries in which we operate, particularly China and the Philippines; and

•political or social unrest, economic instability, conflict or war in such countries, or sanctions implemented by the U.S. against these countries, such as the ongoing geopolitical tensions related to the war between Russia and Ukraine, and resulting sanctions imposed by the U.S. and other countries, and retaliatory actions taken by Russia in response to such sanctions, as well as the war between Israel and Hamas, all of which could have a material adverse effect on our operations.

Our failure to manage any of these risks successfully could harm our future international operations and our overall business.

We may expand through acquisitions of, investments in, or strategic partnerships or other strategic transactions with, other companies, each of which may divert our management’s attention, result in additional dilution to our stockholders, increase expenses, disrupt our operations, and harm our results of operations.

Our business strategy may, from time to time, include acquiring or investing in new or complementary services, technologies or businesses, strategic investments and partnerships, or other strategic transactions, such as our investment in and partnerships with our strategic partners and global service providers such as Avaya, Atos, Amazon, Mitel (Unify), Vodafone, DT, Optus, and Charter Communications. We cannot assure you that we will successfully identify suitable acquisition candidates or transaction counterparties, securely or effectively integrate or manage disparate technologies, lines of business, personnel and corporate cultures, realize our business strategy or the expected return on our investment, or manage a geographically dispersed company. Any such acquisition, investment, strategic partnership, or other strategic transaction could materially and adversely affect our results of operations. The process of negotiating, effecting, and realizing the benefits from acquisitions, investments, strategic partnerships, and strategic transactions is complex, expensive and time-consuming, and may cause an interruption of, or loss of momentum in, development and sales activities and operations of both companies, and we may incur substantial cost and expense, as well as divert the attention of management. We may issue equity securities which could dilute current stockholders’ ownership, incur debt, assume contingent or other liabilities and expend cash in acquisitions, investments, strategic partnerships, and other strategic transactions which could negatively impact our financial position, stockholder equity, and stock price.

Acquisitions, investments, strategic partnerships, and other strategic transactions involve significant risks and uncertainties, including:

•the potential failure to achieve the expected benefits of the acquisition, investment, strategic partnership, or other strategic transaction, including recoupment or write-down of our investments in the partnership;

•unanticipated costs and liabilities;

Table of Contents

•the potential of disputes with our partners and resellers, including arbitration or litigation resulting from a breach or alleged breach of either party’s contractual obligation, which may result in cost, distraction and potential liabilities and reputational damage;

•difficulties in integrating new solutions and subscriptions, software, businesses, operations, and technology infrastructure in an efficient and effective manner;

•difficulties in maintaining customer relations;

•the potential loss of key employees of any acquired businesses;

•the diversion of the attention of our senior management from the operation of our daily business;

•the potential adverse effect on our cash position to the extent that we use cash for the transaction consideration;

•the potential significant increase of our interest expense, leverage, and debt service requirements if we incur additional debt to pay for an acquisition, investment, strategic partnership, or other strategic transaction;

•the potential issuance of securities that would dilute our stockholders’ percentage ownership;

•the potential to incur large and immediate write-offs and restructuring and other related expenses;

•the potential liability or expenses associated with new types of data stored, existing security obligations or liabilities, unknown weaknesses in our solutions, insufficient security measures in place, and compromise of our networks via access to our systems from assets not previously under our control;

•the inability to maintain uniform standards, controls, policies, and procedures;

•the inability to implement new channel models and go-to-market motions; and

•the inability to set up the necessary processes and systems to efficiently operate the partnerships.

Any acquisition, investment, strategic partnership, or other strategic transaction could expose us to unknown liabilities. Moreover, we cannot assure you that we will realize the anticipated benefits of any acquisition, investment, strategic partnership, or other strategic transaction. In addition, our inability to successfully operate and integrate newly acquired businesses or newly formed strategic partnerships appropriately, effectively, and in a timely manner could impair our ability to take advantage of future growth opportunities and other advances in technology, as well as our revenues and gross margins.

In addition, our ability to offer, sell or transfer certain investments may be limited by applicable securities laws and regulations, and our ability to liquidate and realize value from such investments may be negatively and materially impacted by any delays or limitations on our ability to offer, sell, or transfer certain investments. In addition, certain investments are speculative in nature and may be volatile or decline in value or be entirely lost, which could have a negative impact on our future financial position, results of operations, and cash flows.

We may be subject to liabilities on past sales for taxes, surcharges, and fees and our operating results may be harmed if we are required to collect such amounts in jurisdictions where we have not historically done so.

We believe we collect state and local sales tax and use, excise, utility user, and ad valorem taxes, fees, or surcharges in all relevant jurisdictions in which we generate sales, based on our understanding of the applicable laws in those jurisdictions. Such tax, fees and surcharge laws and rates vary greatly by jurisdiction, and the application of such taxes to e-commerce businesses, such as ours, is a complex and evolving area. There is uncertainty as to what constitutes sufficient “in state presence” for a state to levy taxes, fees, and surcharges for sales made over the Internet, and after the U.S. Supreme Court’s ruling in South Dakota v. Wayfair, U.S. states may require an online retailer with no in-state property or personnel to collect and remit sales tax on sales to the state’s residents, which may permit wider enforcement of sales tax collection requirements. Therefore, the application of existing or future laws relating to indirect taxes to our business, or the audit of our business and operations with respect to such taxes or challenges of our positions by taxing authorities, all could result in increased tax liabilities for us or our customers that could materially and adversely affect our results of operations and our relationships with our customers. Further, we have in the past and may in the future be audited by federal, state and local tax authorities which could lead to liabilities for past unpaid taxes, fines, and penalties.

Table of Contents

We may be unable to use some or all of our net operating loss and research credit carryforwards, which could materially and adversely affect our reported financial condition and results of operations.

As of December 31, 2023, we have federal net operating loss carryforwards (“NOLs”) of $1.8 billion, of which $66.1 million are set to expire in 2037, while the remaining portion does not expire. Additionally, we have state net operating loss carryforwards of $1.3 billion that will begin to expire in 2024. We also have federal research tax credit carryforwards that will begin to expire in 2028. Realization of these net operating loss and research tax credit carryforwards depends on future income, and there is a risk that our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could materially and adversely affect our reported financial condition and results of operations.

In addition to the potential carryforward limitations described above, under Sections 382 and 383 of the Internal Revenue Code of 1986 (the “Code”), as amended, our ability to utilize NOLs or other tax attributes, such as research tax credits, in any taxable year may be limited if we experience an “ownership change.” An “ownership change” generally occurs if one or more stockholders or groups of stockholders, who each own at least 5% of our stock, increase their collective ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. Similar rules may apply under state tax laws. Furthermore, for taxable years beginning on or after January 1, 2022, the Code eliminated the right to deduct research and development expenditures currently and requires taxpayers to capitalize and amortize U.S. and foreign research and development expenditures over five and fifteen tax years, respectively. We have accounted for such changes in accordance with our understanding of guidance available as of the date of this filing as described in more detail in our financial statements.

No material deferred tax assets have been recognized on our Consolidated Balance Sheets related to these NOLs, as they are fully offset by a valuation allowance. If we have previously had, or have in the future, one or more Section 382 “ownership changes,” including in connection with our initial public offering or another offering, or if we do not generate sufficient taxable income, we may not be able to utilize a material portion of our NOLs, even if we achieve profitability. If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs. This could materially and adversely affect our reported financial condition and results of operations.

If we are unable to effectively process local number and toll-free number portability provisioning in a timely manner, our growth may be negatively affected.

We support local number and toll-free number portability, which allows our customers to transfer to us and thereby retain their existing phone numbers when subscribing to our services. Transferring numbers is a manual process that can take up to 15 business days or longer to complete. A new customer of our subscriptions must maintain both our subscription and the customer’s existing phone service during the number transferring process. Any delay that we experience in transferring these numbers typically results from the fact that we depend on third-party global service providers to transfer these numbers, a process that we do not control, and these third-party global service providers may refuse or substantially delay the transfer of these numbers to us. Local number portability is considered an important feature by many potential customers, and if we fail to reduce any related delays, we may experience increased difficulty in acquiring new customers. Moreover, the Federal Communications Commission (the “FCC”) requires Internet voice communications providers to comply with specified number porting timeframes when customers leave our subscription for the services of another provider. Several international jurisdictions have imposed similar number portability requirements on subscription providers like us. If we or our third-party global service providers are unable to process number portability requests within the requisite timeframes, we could be subject to fines and penalties. Additionally, in the U.S., both customers and global service providers may seek relief from the relevant state public utility commission, the FCC, or in state or federal court for violation of local number portability requirements.

Our business could suffer if we cannot obtain or retain direct inward dialing numbers or are prohibited from obtaining local or toll-free numbers or if we are limited to distributing local or toll-free numbers to only certain customers.

Our future success depends on our ability to procure large quantities of local and toll-free direct inward dialing numbers (“DIDs”) in the U.S. and foreign countries in desirable locations at a reasonable cost and without restrictions. Our ability to procure and distribute DIDs depends on factors outside of our control, such as applicable regulations, the practices of the communications global service providers that provide DIDs, the cost of these DIDs, and the level of demand for new DIDs. For instance, in France, new rules requiring service providers to obtain DIDs directly from regulatory authorities have been implemented and the regulating authority has not yet addressed the rules’ impact on existing DIDs that were assigned and sub-allocated before such new rules went into effect. Further, due to their limited availability, there are certain popular area code prefixes that we generally cannot obtain. Our inability to acquire DIDs for our operations would make our subscriptions less

Table of Contents

attractive to potential customers in the affected local geographic areas. In addition, future growth in our customer base, together with growth in the customer bases of other providers of cloud-based business communications, has increased, which increases our dependence on needing sufficiently large quantities of DIDs.

We may not be able to manage our inventory levels effectively, which may lead to inventory obsolescence that would force us to incur inventory write-downs.

Our vendor-supplied phones have lead times of up to several months for delivery to our fulfillment agents and are built to forecasts that are imprecise. It is likely that, from time to time, we will have either excess or insufficient product inventory. In addition, because we rely on third-party vendors for the supply of our vendor-supplied phones, our inventory levels are subject to the conditions regarding the timing of purchase orders and delivery dates that are not within our control. Excess inventory levels would subject us to the risk of inventory obsolescence, while insufficient levels of inventory may negatively affect relations with customers. For instance, our customers rely upon our ability to meet committed delivery dates, and any disruption in the supply of our services could result in loss of customers or harm to our ability to attract new customers. Any reduction or interruption in the ability of our vendors to supply our customers with vendor-supplied phones could cause us to lose revenue, damage our customer relationships and harm our reputation in the marketplace. Any of these factors could have a material adverse effect on our business, financial condition or results of operations.

We currently depend on a limited number of phone device suppliers and fulfillment agents to configure and deliver the phones that we sell and any delay or interruption in manufacturing, configuring and delivering by these third parties would result in delayed or reduced shipments to our customers and may harm our business.

We rely on a limited number of suppliers to provide phones that we offer for sale to our customers that use our services, and we rely on a limited number of fulfillment agents to configure and deliver the phones that we sell to our customers. Accordingly, we could be adversely affected if such third parties fail to maintain competitive phones or configuration services or fail to continue to make them available on attractive terms, or at all.

If our fulfillment agents are unable to deliver phones of acceptable quality, or if there is a reduction or interruption in their ability to deliver the phones in a timely manner including due to the end of life of any particular unit, our ability to bring services to market, the reliability of our services and our relationships with customers or our overall reputation in the marketplace could suffer, which could cause us to lose revenue. We expect that it could take several months to effectively transition to new third-party manufacturers or fulfillment agents.

If our vendor-supplied phones are not able to interoperate effectively with our own back-end servers and systems, our customers may not be able to use our subscriptions, which could harm our business, financial condition and results of operations.

Hard phones must interoperate with our back-end servers and systems, which contain complex specifications and utilize multiple protocol standards and software applications. Currently, the phones used by our customers are manufactured by a limited number of third-party providers. If any of these providers changes the operation of their phones, we will be required to undertake development and testing efforts to ensure that the new phones interoperate with our system. In addition, we must be successful in integrating our solutions with strategic partners’ devices in order to market and sell these solutions. These efforts may require significant capital and employee resources, and we may not accomplish these development efforts quickly or cost-effectively, if at all. If our vendor-supplied phones do not interoperate effectively with our system, our customers’ ability to use our subscriptions could be delayed or orders for our subscriptions could be canceled, which would harm our business, financial condition, and results of operations.

The global COVID-19 pandemic or any future pandemics could harm our business, financial condition and results of operations.

The COVID-19 pandemic impacted worldwide economic activity and financial markets, and forced us to take measures such as temporarily closing our offices and restricting travel. Any resurgence of COVID-19 or any other future pandemic could again result in temporarily suspending travel and restricting the ability to do business in person, which could negatively affect our customer success efforts, sales, and marketing efforts, challenge our ability to enter into customer and other commercial contracts in a timely manner and our ability to source, assess, negotiate, and successfully implement and execute on, and realize the benefits of, acquisitions, investments, strategic partnerships and other strategic transactions, slow down our recruiting efforts, or create operational or other challenges, any of which could harm our business, financial condition

Table of Contents

and results of operations. In addition, COVID-19 or any future pandemic could disrupt the operations of our customers, channel partners, strategic partners, global service providers, suppliers and other third-party providers, and could generally adversely affect economies and financial markets globally in the future, both of which could decrease technology spending and adversely affect demand for our solutions and harm our business.

Risks Related to Regulatory Matters

Our subscriptions are subject to regulation, and future legislative or regulatory actions could adversely affect our business and expose us to liability in the U.S. and internationally.

Federal Regulation

Our business is regulated by the FCC. As a communications services provider, we are subject to existing or potential FCC regulations relating to privacy, disability access, access to and porting of numbers and enabling abbreviated dialing to designated numbers, maintaining records for disconnected numbers, cooperation with law enforcement, Federal Universal Service Fund (“USF”) contributions, Enhanced 911 (“E-911”), outage reporting, call authentication, call spoofing, call blocking and other requirements and regulations. The FCC is increasing enforcement of call authentication and related Know-Your-Customer obligations and continues to adopt and consider additional rules related to robocalling and robotexting. FCC classification of our Internet voice communications services as telecommunications services could result in additional federal and state regulatory obligations. If we do not comply with FCC rules and regulations, we could be subject to FCC enforcement actions, fines, loss of licenses or authorizations, repayment of funds, and possibly restrictions on our ability to operate or offer certain of our subscriptions. Any enforcement action by the FCC, which may be a public process, would hurt our reputation in the industry, possibly impair our ability to sell our subscriptions to customers and could have a materially adverse impact on our revenues.

Through RCLEC, we also provide competitive local exchange carrier (“CLEC”) and IP-enabled (“IPES”) services, which are regulated by the FCC as traditional telecommunications services. Our CLEC services depend on certain provisions of the Telecommunications Act of 1996 that require incumbent local exchange carriers (“ILECs”) to provide us facilities and services that are necessary to provide our services. Over the past several years, the FCC has reduced or eliminated a number of regulations governing ILECs’ wholesale offerings. If ILECs were no longer required by law to provide such services to us, or ceased to provide these services at reasonable rates, terms and conditions, our business could be adversely affected and our cost of providing CLEC services could increase. This could have a materially adverse impact on our results of operations and cash flows.

In addition, the federal Telephone Consumer Protection Act (“TCPA”) and FCC rules implementing the TCPA prohibit sending unsolicited facsimile advertisements or making illegal robocalls, subject to certain exceptions. The FCC may take enforcement action against persons or entities that send “junk faxes,” or make illegal robocalls and individuals also may have a private cause of action. Although the FCC’s rules prohibiting unsolicited fax advertisements or making illegal robocalls apply to those who “send” the advertisements or make the calls, fax transmitters or other service providers that have a high degree of involvement in, or actual notice of, unlawful sending of junk faxes or making of illegal robocalls and have failed to take steps to prevent such transmissions may also face liability under the FCC’s rules, or in the case of illegal robocalls, Federal Trade Commission (“FTC”) rules. We take significant steps designed to prevent our systems from being used to make illegal robocalls or send unsolicited faxes on a large scale, and we do not believe that we have a high degree of involvement in, or notice of, the use of our systems to broadcast junk faxes or make illegal robocalls. However, because fax transmitters and related service providers do not enjoy an absolute exemption from liability under the TCPA and related FCC rules, we could face FCC or FTC inquiry and enforcement or civil litigation, or private causes of action, if someone uses our system for such purposes. If any of these were to occur, we could be required to incur significant costs and management’s attention could be diverted. Further, if we were to be held liable for the use of our service to send unsolicited faxes or make illegal robocalls or to settle any action or proceeding, any judgment, settlement, or penalties could cause a material adverse effect on our operations.

State Regulation

States currently do not regulate our Internet voice communications subscriptions, which are considered to be nomadic because they can be used from any broadband connection. However, a number of states require us to register as a Voice over Internet Protocol (“VoIP”) provider, contribute to state USF, contribute to E-911, and pay other surcharges and annual fees that fund various utility commission programs, while others are actively considering extending their public policy programs to include the subscriptions we provide. We pass USF, E-911 fees, and other surcharges through to our customers, which may

Table of Contents

result in our subscriptions becoming more expensive or require that we absorb these costs. State public utility commissions may attempt to apply state telecommunications regulations to Internet voice communications subscriptions like ours.

RCLEC services are subject to regulation by the public utility regulatory agency in those states where we provide local telecommunications services. This regulation includes the requirement to obtain a certificate of public convenience and necessity or other similar licenses prior to offering our CLEC services, as well as registrations related to IPES services. We may also be required to file tariffs that describe our CLEC services and provide rates for those services. We are also required to comply with regulations that vary by state concerning service quality, disconnection and billing requirements. State commissions also have authority to review and approve interconnection agreements between incumbent phone carriers and CLECs such as our subsidiary.

Both we and RCLEC are also subject to state consumer protection laws, including privacy requirements, as well as U.S. state or municipal sales, use, excise, gross receipts, utility user and ad valorem taxes, fees, or surcharges.

International Regulation

As we expand internationally, we may be subject to telecommunications, consumer protection, data protection, emergency call services, and other laws, regulations, taxes, and fees in the foreign countries where we offer our subscriptions. Any foreign regulations could impose substantial compliance costs on us, restrict our ability to compete, and impact our ability to expand our service offerings in certain markets. Moreover, the regulatory environment is constantly evolving and changes to the applicable regulations could impose additional compliance costs and require modifications to our technology and operations and go to market practices. European Union member states are currently implementing the new European Electronic Communications Code, including major modifications to the telecommunication laws and regulations in Germany, United Kingdom, and France. Updated regulations in Europe and in the United Kingdom require providers to perform assessments on the security and resilience of their networks as well as on the accuracy of their metering and billing systems. New guidelines in the United Kingdom and other European countries require providers to implement Know-Your-Customer vetting which may complicate and elongate the sales process. Local telecom regulatory restrictions in France limit our ability to sell numbers and other services in a wholesale motion to channel partners; other European countries have passed or are considering similar regulations. The recent EU Digital Service Act requires cloud and digital providers to adopt measures to prevent disinformation, increase transparency and improve protection for users of digital services in the EU. Internationally, we currently sell our subscriptions in Canada, the U.K., Australia, Singapore, and several European countries. We also offer our Global MVP solution, enabling our multinational customers in locations where we sell our solutions, to establish local phone solutions in various countries internationally. We may be subject to telecommunications, consumer protection, data protection, emergency call services, call authentication, and other laws and regulations in additional countries as we continue to expand our Global MVP solution internationally.

In addition, our international operations are potentially subject to country-specific governmental regulation and related actions that may increase our costs or impact our solution and service offerings or prevent us from offering or providing our solutions and subscriptions in certain countries. Certain of our subscriptions may be used by customers located in countries where VoIP and other forms of IP communications may be illegal or require special licensing or in countries on a U.S. embargo list. Even where our solutions are reportedly illegal or become illegal or where users are located in an embargoed country, users in those countries may be able to continue to use our solutions and subscriptions in those countries notwithstanding the illegality or embargo. We may be subject to penalties or governmental action if customers continue to use our solutions and subscriptions in countries where it is illegal to do so, and any such penalties or governmental action may be costly and may harm our business and damage our brand and reputation. We may be required to incur additional expenses to meet applicable international regulatory requirements or be required to discontinue those subscriptions if required by law or if we cannot or will not meet those requirements.

The increasing growth and popularity of Internet voice communications, video conferencing and messaging heighten the risk that governments will regulate or impose new or increased fees or taxes on these services. To the extent that the use of our subscriptions continues to grow, and our user base continues to expand, regulators may be more likely to seek to regulate or impose new or additional taxes, surcharges or fees on our subscriptions.

Table of Contents

We process, store, and use personal information and other data, which subjects us and our customers to a variety of evolving international statutes, governmental regulation, industry standards and self-regulatory schemes, contractual obligations, and other legal obligations related to privacy and data protection, which may increase our costs, decrease adoption and use of our solutions and subscriptions, and expose us to liability.

In the course of providing our services, we collect, store, and process many types of data, including personal data. Moreover, our customers can use our subscriptions to store contact and other personal or identifying information, and to process, transmit, receive, store, and retrieve a variety of communications and messages, including information about their own customers and other contacts. Customers are able, and may be authorized under certain circumstances, to use our subscriptions to transmit, receive, and/or store personal information, which may include, among others, personally identifiable health, financial, and other sensitive information.

RingCentral’s collection, storage, retention, use, processing, transmission, sharing, disclosure, and safeguarding of personal data (collectively, “processing”) is subject to myriad obligations and restrictions flowing from law, regulation, industry standards, and contract. In addition to U.S. federal, state, and local law and regulation, RingCentral is subject to numerous foreign laws and regulations governing these matters where we do business throughout the world. The scope and status of these obligations and restrictions is uncertain, changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other rules. Failure to comply with obligations and restrictions related to data privacy, data protection, and security in any jurisdiction in which we operate could subject us to lawsuits, fines, criminal penalties, statutory damages, consent decrees, injunctions, adverse publicity, and other losses that could harm our business.

For example, the GDPR, which came into force in May 2018, strengthened existing data protection regulations in the EU. Its provisions include increasing the maximum level of fines that EU regulators may impose for the most serious of breaches to the greater of €20 million or 4% of worldwide annual turnover. National data protection supervisory authorities have been actively monitoring and sanctioning noncompliance with applicable regulations with particular focus on use of cookies without consent, behavioral profiling, protection of children data, and breach of security. The authority to impose such fines is in addition to (i) the rights of individuals to sue for damages in respect of any data privacy breach that causes them to suffer harm and (ii) the right of individual member states to impose additional sanctions over and above the administrative fines specified in the GDPR. Other European countries have adopted omnibus privacy laws that are based on or similar to the GDPR or are updating their existing privacy laws to reflect GDPR standards, including Switzerland, the United Kingdom, and members of the European Economic Area (the “EEA”).

Among other requirements, these laws regulate data transferred to countries that have not been found to provide adequate protection to such personal data. On July 10, 2023, the EU Commission adopted the EU-U.S. Data Privacy Framework (“DPF”) to facilitate data flows between the U.S. and the EU. The U.S. and Switzerland have also agreed on a similar DPF. We have self-certified compliance with the EU-U.S. DPF, and the Swiss-U.S. DPF for non-HR data. The U.K. also approved an addendum to the EU DPF to support personal data transfers from the U.K. to the U.S. in September of 2023, and we have self-certified compliance with that framework. The impact of the DPF on data transfers from Europe remains to be seen, and as such uncertainty regarding some details for cross-border data transfers remains. Legal challenges to the adequacy of the DPF have commenced, and there is uncertainty with respect to the speed and the outcome of the legal challenges.

In addition to the DPF, we continue to rely on the EU Commission’s Standard Contractual Clauses (“SCCs”), updated in 2021, for the transfer of personal data from the EU to countries not deemed by the EU Commission as providing adequate protection of personal data (e.g., the U.S.). We adopted the 2021 SCCs with our customers and our suppliers transferring data out of the EEA and Switzerland (with approved modifications by the Swiss Federal Data Protection and Information Commissioner). On March 21, 2022, the U.K. Parliament approved the use of an International Data Transfer Agreement or a U.K.-specific addendum to the EU SCCs (collectively, the “U.K. SCCs”) to support personal data transfers out of the U.K., which we adopted as a supplemental means to support data transfers from customers and suppliers in the U.K. to other jurisdictions, including the U.S. and the EU. Despite this, it may be difficult to maintain appropriate safeguards for the transfer of such data from the EEA, Switzerland, and U.K. (collectively, “Europe”), as a result of continued legal and legislative activity that has challenged or called into question existing means of data transfers to countries that have not been found to provide adequate protection for personal data.

Following the U.K.’s exit from the EU, the U.K. largely adopted the EU rules on cross-border data flows, but allowed flexibility to diverge. On June 28, 2021, the European Commission issued an adequacy decision under the GDPR and the Law Enforcement Directive, pursuant to which personal data generally may be transferred from the EU to the U.K. without restriction; however, this adequacy decision is subject to a four-year “sunset” period, after which the European Commission’s adequacy decision may be renewed. If the adequacy decision is not renewed, RingCentral’s (and other U.S. companies’) ability to transfer personal data from the EU to the U.K. for operational purposes could potentially be affected. RingCentral’s

Table of Contents

implementation of the U.K. SCCs may mitigate but does not eliminate the risk associated with non-renewal of the European Commission’s adequacy decision.

The current SCCs (EU, Swiss, and U.K.) include requirements to conduct personal data transfer impact assessments before transferring personal data out of the EEA, Switzerland, and the U.K. The assessment requires the parties to consider the specific circumstances of the transfer, the laws, and practices of the destination country, particularly relating to government access, and any additional relevant contractual, technical, or organizational safeguards. Each party is required to perform such an assessment and determine whether the transfer can proceed or must be suspended if there are insufficient safeguards to protect the transfer of personal data.

We may, in addition to other impacts, experience additional costs associated with increased compliance burdens following the implementation of the 2021 SCCs and U.K. SCCs, including requirements to conduct the personal data transfer impact assessments described above, block, or require ad hoc verification of measures taken with respect to certain data flows from the EEA, Switzerland and the U.K. to the U.S and other non-EEA countries. Additionally, we and our customers face the potential for regulators in the EEA, Switzerland, or the U.K. to apply different standards to the transfer of personal data from the EEA, Switzerland, or the U.K. to the U.S. and other countries. Moreover, as regulatory requirements continue to change, RingCentral (and other U.S. companies) may be required to negotiate new contractual data protection obligations with new and existing vendors or third parties that aid in processing personal data on our behalf.

Outside of Europe, many other countries, including most countries where RingCentral provides services, have adopted or are considering adoption of data protection legislation based on the GDPR or its predecessor, the EU Data Protection Directive, including India, Australia, Brazil, Canada, China, Israel, Japan, New Zealand, Singapore, South Africa, and South Korea. Several of these countries, including Australia and Canada, are actively considering legislative proposals to enhance existing privacy regulation. Quebec’s Privacy Act, much of which came into effect in October 2023, imposes stringent new requirements for securing consent for personal data processing including via cookies, internal data governance, data transfers, use of personal data for marketing, and disclosure of automated processing. As implementation and enforcement of these existing and new laws and regulations progress, we could experience additional costs associated with increased compliance burdens and contractual obligations, be required to localize certain personal data, and/or be at risk for increased regulatory fines or damages.

In particular, the Data Security Law of China (“DSL”), which took effect on September 1, 2021, and the Personal Information Protection Law of China (“PIPL”), which took effect on November 1, 2021, implement comprehensive regulation of data and personal data processing activities across all industries. The DSL and PIPL apply not only to the processing of data within China, but also cross-border data transfers as well as certain activities outside of China that relate to data originating from China. Restrictions imposed by the DSL and PIPL, including strict data localization requirements applicable to certain types of personal data, and uncertainty regarding their application in practice may impact us and our customers, and we may be required to implement modifications to our policies and practices in an effort to comply with these laws.

In the U.S., there are numerous federal and state laws governing the privacy and security of personal information. In particular, at the federal level, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) establishes privacy and security standards that limit the use and disclosure of individually identifiable health information and requires the implementation of administrative, physical, and technical safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity, and availability of electronic protected health information by certain institutions. We act as a “Business Associate” through our relationships with certain customers and are thus directly subject to certain provisions of HIPAA. In addition, if we are unable to protect the privacy and security of protected health information, we could be found to have breached our contracts with customers with whom we have a Business Associate relationship and may also face regulatory liability. Recently, a number of states, including Washington, Connecticut, and Nevada, have adopted laws regulating the processing of consumer health data not regulated by HIPAA. Once in effect, these laws could impose additional costs related to compliance, in particular in handling consumer requests for access, deletion, and to exercise other rights. The Gramm-Leach-Bliley Act (“GLBA”) imposes obligations with respect to personal data that we process on behalf of financial institutions. The FTC, which enforces the GLBA in the context of non-bank financial institutions, adopted new breach notification rules in October, 2023. Additionally, we are subject to FCC regulations imposing obligations related to our use and disclosure of certain data related to our interconnected VoIP service. If we experience a data security incident, we may be required by state law or FCC or other regulations to notify our customers and/or law enforcement. We may also be subject to FTC enforcement actions if the FTC has reason to believe we have engaged in unfair or deceptive privacy or data security practices. The FTC has also published an Advance Notice of Proposed Rulemaking seeking public comment on the need for new regulation of ‘commercial surveillance.’

Table of Contents

While Congress is actively considering comprehensive privacy legislation, U.S. states have taken the lead. California, for example, has enacted and subsequently amended (pursuant to a ballot initiative known as the California Privacy Rights Act) the California Consumer Privacy Act (“CCPA”). Pursuant to the CCPA, we are required, among other things, to make certain enhanced disclosures to California residents regarding our use or disclosure of their personal information, allow California residents to opt-out of certain uses and disclosures of their personal information without penalty, provide Californians with other choices related to personal data in our possession, and obtain opt-in consent before engaging in certain uses of personal information relating to Californians under the age of 16. The California Attorney General may seek substantial monetary penalties and injunctive relief in the event of our non-compliance with the CCPA. The CCPA also allows for private lawsuits from Californians in the event of certain data breaches. Further, the Virginia Consumer Data Protection Act, a comprehensive privacy statute that shares similarities with the CCPA, CPRA, and legislation proposed in other states, came into effect on January 1, 2023. Colorado enacted a similar law, the Colorado Privacy Act, on June 8, 2021, which came into effect as of July 1, 2023. Utah enacted a similar law, the Utah Consumer Privacy Act, on March 24, 2022, which came into effect as of December 31, 2023, and Connecticut enacted a similar law, An Act Concerning Personal Data Privacy and Online Monitoring, on May 10, 2022, which came into effect as of July 1, 2023. Iowa’s Consumer Data Protection Act will become effective on January 1, 2025. Further, Indiana has enacted the Indiana Consumer Data Protection Act, which will take effect January 1, 2026; Montana has adopted the Montana Consumer Data Protection Act, which will go into effect on October 1, 2024; Tennessee has adopted the Tennessee Information Protection Act, which will become effective July 1, 2025; Florida has enacted a new privacy law, SB 262, which will become effective July 1, 2024; Texas has enacted the Texas Data and Privacy Security Act, which generally becomes effective July 1, 2024; Oregon has enacted the Oregon Consumer Privacy Act, which generally becomes effective July 1, 2024; Delaware has enacted the Delaware Personal Data Privacy Act, which generally becomes effective as of January 1, 2025; and New Jersey has enacted the New Jersey Privacy Act, which generally becomes effective as of January 15, 2025. A number of other states are considering similar laws. When in effect, all of these laws give consumers additional rights to control the collection, use, and sharing of personal data, including the right to opt-out of the sale or sharing of their data for marketing and, in many cases obligate require opt-in consent to process sensitive personal data. The right to opt-out of personal data processing may impact our marketing activities, particularly those that involve the use of third-party cookies on our websites. This may require that we implement specific contractual terms when we engage marketing entities to market our product and services and may limit our efforts to reach our target audience, as well as require us to implement opt-out icons on our websites. All of these new and evolving state laws have created further uncertainty and may require us to enter into additional contractual terms with customers and vendors, modify our policies and practices, and otherwise incur additional costs and expenses, in our efforts to comply. The U.S. federal government also is contemplating federal privacy legislation.

Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA (including contractual obligations under any Business Associate agreement), GLBA, and state privacy laws may lead to significant fines, civil and criminal penalties, or liabilities. The U.S. Department of Health and Human Services (“HHS”) audits the compliance of Business Associates and enforces HIPAA privacy and security standards. HHS enforcement activity has become more significant over the last few years and HHS has signaled its intent to continue this trend. Violation of the FCC’s privacy rules can result in large monetary forfeitures and injunctive relief. The FTC has broad authority to seek monetary redress for affected consumers and injunctive relief. In addition to federal regulators, state attorneys general (and, in some states, individual residents) are authorized to bring civil actions seeking either injunctions or damages (generally ranging from $2,500 to $7,500 per violation, but up to $20,000 in Colorado) to the extent violations implicate the privacy of state residents. Class action lawsuits are common in the event of a data breach affecting financial or other forms of sensitive information.

Legislators and regulators in the United States and elsewhere are increasingly focused on privacy protections for minors under 18 years of age. While RingCentral does not knowingly provide products or services directly to children under the age of 16, or knowingly collect or solicit personal information from or about children under the age of 16 outside of the school offering, recent state legislation will, when in effect, impose new obligations on online services where it is “reasonable to expect” that the service, product, or feature would be accessed by older teens, including, in some cases, 16 and 17 year old children. On September 15, 2022, California passed the California Age-Appropriate Design Code Act, which is currently subject to a judicial stay but could become enforceable as early as July 1, 2024. Similar legislation has been adopted or introduced in numerous states, including, for example, Connecticut, Colorado, Florida, Arkansas, and Texas. Congress is also actively considering legislation regulating the collection, use, and disclosure of personal information about minors. For example, the Kids Online Safety Act (“KOSA”) and amendments to the Children’s Online Privacy Protection Act (“COPPA 2.0”) would, if enacted, impose new obligations with respect to data collected from minors under 17 years of age. Both KOSA and COPPA 2.0 have been unanimously approved by the Senate Commerce Committee on two separate occasions. The FCC recently announced the creation of a new Privacy and Data Protection Task Force to coordinate rulemaking and enforcement across the agency and may be contemplating the creation of new rules regarding processing of personal information about communications services subscribers. The National Telecommunications and Information Administration (NTIA) of the U.S. Department of Commerce announced on September 28, 2023, its plans to issue a Request for Comment on health, safety, and

Table of Contents

privacy concerns associated with the use of online platforms by minors. Outside of the United States, the U.K.’s Information Commissioner’s Office has published the Age Appropriate Design Code, which it uses to evaluate compliance with the U.K. GDPR. The U.K.’s Online Safety Bill, which received royal assent in October 2023, will regulate the design and operation of online platforms that provide “user to user” interactivity. Many of these new and evolving laws and regulations have required and will continue to require us to incur costs and expenses and will require us to incur additional costs and expenses, in our efforts to comply.

RNG US Equity

RNG · 10-K · period ended 2023-12-31

ITEM 1A. RISK FACTORS

RNG US Equity☆

RNG · 10-K · period ended 2023-12-31

ITEM 1A. RISK FACTORS

RNG US Equity