EPAM, §1A diff (2020 → 2021)

9

Table of Contents

Item 1A. Risk Factors

Our operations and financial results are subject to various risks and uncertainties, which could adversely affect our business, financial condition, results of operations, cash flows, and the trading price of our common stock. Listed below, not necessarily in order of importance or probability of occurrence, are the most significant risk factors applicable to us. Additionally, forward-looking statements are inherently subject to risks and uncertainties, some of which cannot be predicted or quantified. See “Forward-Looking Statements.”

Risks Related to COVID-19

Our results of operations have been adversely affected and could in the future be materially adversely affected by the COVID-19 pandemic.

The COVID-19 pandemic has contributed to significant volatility in the price of our common stock, created uncertainty in customer demand for, and ability to supply, our services and caused widespread economic disruption. The extent to which the coronavirus pandemic will continue to impact our business, operations and financial results will depend on numerous factors that frequently change or are unknown, and that we may not be able to accurately predict. Those factors include: the duration and scope of the pandemic; governmental, business and individuals’ responses or planned responses to the pandemic, including availability, administration rates, and acceptance of vaccines and therapeutics, and the availability of diagnostic supplies; the impact of the pandemic on economic activity, supply chains, and inflation; any interventions or government measures intended to mitigate economic and supply disruptions; the effect on our customers and customer demand for our products, services, and solutions; our ability to sell and provide our products, services, and solutions, including as a result of travel restrictions and personnel availability; the ability of our customers to pay timely, if at all, for our services and solutions with or without discounts requested by our customers; bankruptcy or other insolvency procedures among our customers or suppliers; and closures of our and our customers’ offices and facilities. Restrictions on access to our customers and their facilities, and broad disruptions in our customers’ markets , has disrupted, and could continue to disrupt the demand for our products, services, and solutions and result in, among other things, termination of customer contracts, delays or interruptions in the performance of contracts, losses of revenues, reduced profitability, and an increase in bad debt expense. Customers have and may continue to slow or halt decision making, delay planned work, or suspend, terminate, fail to renew, or reduce existing contracts or services. Travel and immigration restrictions may delay or prevent our personnel from accessing worksites, and remote working arrangements increase information security, cyber security and connectivity vulnerabilities. In addition, new coronavirus variants and eased COVID-19-related restrictions on businesses and consumers could affect our ability to deliver services to our customers because of an outbreak of illness among our employees, our customers’ employees, or at a facility. Moreover, there may be additional costs that we will have to incur in connection with further changes in response to the COVID-19 pandemic or a return to prior operating conditions. To the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this section of this Annual Report on Form 10-K for the year ended December 31, 2021, including, but not limited to, those relating to our operations in emerging markets, our ability to execute on our growth strategy through strategic acquisitions, our dependency on third parties for network infrastructure, attracting, hiring, and retaining personnel, the effects on movements in foreign currency exchange rates, and the effects that changes to fiscal, political, regulatory and other federal policies may have on EPAM, each of which could materially adversely affect our business, financial condition, results of operations and/or stock price.

Risks Related to Our Personnel and Growth

We may be unable to effectively manage our rapid growth or achieve anticipated growth, which could place significant strain on our management, systems, resources, and results of operations.

We have grown rapidly and significantly expanded our businesses over the past several years, both organically and through strategic acquisitions and investments. Our growth has resulted in part from managing larger and more complex projects for our customers, but consequently requires that we invest substantial amounts of cash in human capital and the infrastructure to support them, including training, administration, and facilities. Our rapid growth places significant demands on our management and our administrative, operational and financial infrastructure, and creates challenges, including:

•recruiting, training and retaining sufficiently skilled professionals and management personnel;

•planning resource utilization rates on a consistent basis and efficiently using on-site, off-site and offshore staffing;

•maintaining close and effective relationships with a larger number of customers in a greater number of industries and locations;

•controlling costs and minimizing cost overruns and project delays in delivery center and infrastructure expansion;

•effectively maintaining productivity levels and implementing process improvements across geographies and business units; and

•evolving our information security and our internal administrative, operational and financial infrastructure.

We intend to continue our expansion and pursue available opportunities for the foreseeable future. We have and will continue to invest in new lines of business, such as software development education and expanded consulting services. As we introduce new services, enter into new markets, and take on increasingly large and complex projects, our business may face new risks and challenges. If customers do not choose us for large and complex projects or we do not effectively manage those projects, our reputation may be damaged and our business and financial goals may not be realized. Direct-to-consumer offerings in the highly regulated professional education industry could result in increased liability and compliance costs. We need to generate business and revenues to support new investments and infrastructure projects. If the challenges associated with expansion negatively impact our anticipated growth and margins, our business, prospects, financial condition and results of operations could be materially adversely affected.

We must successfully attract, hire, train and retain qualified personnel to service our customers’ projects and we must productively utilize those personnel to remain profitable.

Identifying, recruiting, hiring and retaining professionals with diverse skill sets across our broad geography of operations is critical to maintaining existing engagements and obtaining new business and has become more challenging in the economic and labor climate caused by the COVID-19 pandemic. If we are unable to recruit skilled professionals and if we do not deploy those professionals and use our physical infrastructure and fixed-cost resources productively, our profitability will be significantly impacted. We must manage the utilization levels of the professionals that we hire and train by planning for future needs effectively and staffing projects appropriately while accurately predicting the general economy and our customers’ need for our services. If we are unable to attract, hire, train, and retain highly skilled personnel and productively deploy them on customer projects, we will jeopardize our ability to meet our customers’ expectations and develop ongoing and future business, which could adversely affect our financial condition and results of operations.

Competition for highly skilled professionals has intensified in the markets where we operate, and we may experience significant employee turnover rates due to such competition. If we are unable to retain professionals with specialized skills, our revenues, operating efficiency and profitability will decrease. Cost reductions, such as reducing headcount, or voluntary departures that result from our failure to retain the professionals we hire, could negatively affect our reputation as an employer and our ability to hire personnel to meet our business requirements. Price increases resulting from increasing compensation to retain personnel could lead to a decline in demand for our services.

There may be adverse tax and employment law consequences if the independent contractor status of some of our personnel or the exempt status of our employees is successfully challenged.

In several countries, certain of our personnel and certain of the personnel of companies that we have acquired are retained as independent contractors. The criteria to determine whether an individual is considered an independent contractor or an employee are typically fact sensitive and vary by jurisdiction, as can the interpretation of the applicable laws. If a government authority changes the applicable laws or a court makes any adverse determination with respect to independent contractors in general or one or more of our independent contractors specifically, we could incur significant costs, including for prior periods, for tax withholding, social security taxes or payments, workers’ compensation and unemployment contributions, and recordkeeping, or we may be required to modify our business model, any of which could materially adversely affect our business, financial condition and results of operations and increase the difficulty in attracting and retaining personnel.

Our success depends substantially on the continuing efforts of our senior executives and other key personnel, and our business may be severely disrupted if we lose their services.

Our future success heavily depends upon the continued services of our senior executives and other key employees. If one or more of our senior executives or key employees are unable or unwilling to continue in their present positions, we may not be able to replace them easily or at all. If any of our senior executives or key personnel joins a competitor or forms a competing company, we may lose customers, suppliers, know-how and other key personnel to those competitors. If we are unable to attract new senior executives or key personnel due to the intense competition for talent in our industry, it could disrupt our business operations and growth.

11

If we fail to integrate or manage acquired companies efficiently and effectively, or if acquisitions do not perform to our expectations, our overall profitability and growth plans could be materially adversely affected.

Strategic acquisitions are part of our expansion strategy, but these transactions involve significant risks. Acquired companies may not advance our business strategy or achieve a satisfactory return on our investment, we may not be able to successfully integrate acquired employees and business culture, customer relationships, or operations, and acquisitions divert significant management attention and financial resources from our ongoing business. Furthermore, contracts between our acquired companies and their customers may lack terms and conditions that adequately protect us against the risks associated with the services we provide, and our acquired companies' business operations can expose us to potential liability before integration is complete. If not effectively managed, the disruption of our ongoing business, increases in our expenses, including significant one-time expenses and write-offs, and difficulty and complexity of effectively integrating acquired operations may adversely affect our overall growth and profitability.

Risks Related to Our Operations

Instability in geographies where we have significant operations and personnel or where we derive substantial amounts of revenue could have a material adverse effect on our business, customers, service delivery, and financial results.

Economic, civil, military, and political uncertainty exists and may increase in many of the regions where we operate and derive our revenue. Several countries in which we operate are experiencing and may continue to experience military action and civil and political unrest. We have significant operations in the emerging market economies of Eastern Europe and more than half of our global delivery, administrative and support personnel are located in Ukraine, Belarus and Russia.

In late February 2022, Russian military forces launched significant military action against Ukraine, and sustained conflict and disruption in the region is likely. The impact to Ukraine, as well as actions taken by other countries, including new and stricter sanctions by Canada, the United Kingdom, the European Union, the U.S. and other countries and organizations against officials, individuals, regions, and industries in Russia, Ukraine and Belarus, and each country’s potential response to such sanctions, tensions, and military actions could have a material adverse effect on our operations. In order to protect against potential cyberattacks or other information security threats, some of our customers are considering or have implemented steps to block internet communications with Russia, Ukraine, and Belarus, which could have a material adverse effect on our ability to deliver our services from those locations. Any such material adverse effect from the conflict and enhanced sanctions activity may disrupt our delivery of services, cause us to shift all or portions of our work occurring in the region to other countries, and may restrict our ability to engage in certain projects in the region or involving certain customers in the region.

EPAM is actively monitoring and enhancing the security of our people and the stability of our infrastructure, including communications and internet availability. We execute our business continuity plans and adapt to developments as they occur to protect the safety of our personnel and address potential impacts to our delivery infrastructure. To date we have not experienced any material interruptions in our infrastructure, utility supply or internet connectivity needed to support our customers. We have developed and, in some cases, implemented additional contingency plans to relocate work and/or personnel to other geographies within our global footprint and add new locations, as appropriate. Our business continuity plans are designed to address known contingency scenarios to ensure that we have adequate processes and practices in place to protect the safety of our people and to handle potential impacts to our delivery capabilities. Our crisis management procedures, business continuity plans, and disaster recovery capabilities may not be effective at preventing or mitigating the effects of prolonged or multiple crises, such as civil unrest, military conflict, and a pandemic in a concentrated geographic area. The current events in the regions where we operate and where we derive a significant amount of our business may pose security risks to our people, our facilities, our operations, and infrastructure, such as utilities and network services, and the disruption of any or all of them could materially adversely affect our operations, financial results, and cause volatility in the price of our stock. We have no way to predict the progress or outcome of the military action in Ukraine or its impacts in Russia and Belarus as the conflict and government reactions are rapidly developing and beyond our control. Whether in these countries or in others in which we operate, prolonged civil unrest, political instability or uncertainty, military activities, or broad-based sanctions, should they continue for the long term or escalate, could require us to rebalance our geographic concentrations and could have a material adverse effect on our personnel, operations, and business outlook.

12

Increases in wages, equity compensation, and other compensation expenses could prevent us from sustaining our competitive advantage, increase our costs, and result in dilution to our stockholders.

Wages for technology professionals in the emerging markets where we have significant operations and delivery centers are lower than comparable wages in more developed countries. However, wages in general, and in the technology industry in these countries in particular, increased at a faster rate than in the past, which may make us less competitive unless we are able to increase the efficiency and productivity of our people. If we increase operations and hiring in more developed economies, our compensation expenses will increase because of the higher wages demanded by technology professionals in those markets. Wage inflation, whether driven by competition for talent or ordinary course pay increases, may also increase our cost of providing services and reduce our profitability if we are not able to pass those costs on to our customers or adjust prices when justified by market demand.

We expect to continue our practice of granting equity-based awards under our stock incentive plans and paying other stock-based compensation. The expenses associated with stock-based compensation may make issuing equity awards under our equity incentive plans less attractive to us, but if we reduce the amount or value of equity award grants, we may not be able to attract and retain key personnel. Conversely, if we grant more or higher value equity awards to attract and retain key personnel, the equity compensation expenses could materially adversely affect our results of operations. New regulations, volatility in our stock, and dilution to our stockholders could diminish our use and the value of our equity-based awards. This could put us at a competitive disadvantage or cause us to reconsider our compensation practices.

Our operations in emerging markets subject us to greater economic, financial, and banking risks than we would face in more developed markets.

Our significant operations in emerging market economies in Eastern Europe, India and certain other Asian countries are vulnerable to market and economic volatility to a greater extent than more developed markets, which presents risks to our business and operations. A majority of our revenues are generated in North America and Western Europe. However, most of our personnel and delivery centers are located in lower cost locations, including emerging markets. This exposes us to foreign exchange risks relating to revenues, compensation, purchases, capital expenditures, receivables and other balance-sheet items. As we continue to leverage and expand our global delivery model into other emerging markets, a larger portion of our revenues and incurred expenses may be in currencies other than U.S. dollars. Currency exchange volatility caused by economic instability or other factors could materially impact our results. See “Item 7A. Quantitative and Qualitative Disclosures About Market Risk.”

The economies of certain emerging market countries where we operate have experienced periods of considerable instability and have been subject to abrupt downturns. We have cash in banks in countries such as Belarus, Russia, Ukraine, Kazakhstan, Georgia, Armenia and Uzbekistan, where the banking sector generally does not meet the banking standards of more developed markets, bank deposits made by corporate entities are not insured, and the banking system remains subject to instability. Armed conflict, or the threat of armed conflict, involving Belarus, Russia or Ukraine could contribute to a banking crisis in these countries. A banking crisis, or the bankruptcy or insolvency of banks that receive or hold our funds may result in the loss of our deposits or adversely affect our liquidity and our ability to complete banking transactions in that region. In addition, some countries where we operate may impose regulatory or practical restrictions on the movement of cash and the exchange of foreign currencies within their banking systems, which would limit our ability to use cash across our global operations and increase our exposure to currency fluctuations. Emerging market vulnerability, and especially its impact on currency exchange volatility and banking systems, could have a material adverse effect on our business, financial condition and results of operations.

We face intense and increasing competition for customers and opportunities from onshore and offshore IT services and other consulting companies. If we are unable to compete successfully against competitors, pricing pressures or loss of market share could have a material adverse effect on our business.

The market for our services is highly competitive, and we expect competition to persist and intensify. We face competition from offshore IT services providers in other outsourcing destinations with low wage costs such as India and China, as well as competition from large, global consulting and outsourcing firms and in-house IT departments of large corporations. Customers tend to engage multiple IT services providers instead of using an exclusive IT services provider, which could reduce our revenues or place significant downward pressure on pricing among competing IT services providers. Customers may prefer service providers that have more locations, more personnel, more experience in a particular country or market, or that are based in countries that are more cost-competitive or have the perception of being more stable than some of the emerging markets in which we operate.

13

Current or prospective customers may elect to perform certain services themselves or may be discouraged from transferring services from onshore to offshore service providers, which could harm our ability to compete effectively with competitors that provide services from within the countries in which our customers operate.

Some of our present and potential competitors may have substantially greater financial, marketing or technical resources; therefore, we may be unable to retain our customers or successfully attract new customers. Increased competition, our inability to compete successfully, pricing pressures or loss of market share could have a material adverse effect on our business.

Complying with a wide variety of legal requirements in the jurisdictions where we operate can create risks to our operations and financial condition, including liquidation of the subsidiaries that operate our major delivery centers.

Our global operations require us to comply with a wide variety of foreign laws and regulations, trade or foreign exchange restrictions or sanctions, inflation, unstable civil, political and military situations, labor issues, and legal systems that make it more difficult to enforce intellectual property, contractual, or corporate rights. Certain legal provisions in Russia, Belarus, and Ukraine, where our local subsidiaries operate important delivery centers and employ a significant number of billable and support professionals, may allow a court to order liquidation of a locally organized legal entity on the basis of its formal noncompliance with certain requirements during formation, reorganization or during its operations. If we fail to comply with certain requirements, including those relating to minimum net assets, governmental or local authorities can seek the involuntary liquidation of our local subsidiaries in court, and creditors will have the right to accelerate their claims, demand early performance of legal obligations, and demand compensation for any damages. Involuntary liquidation of any of our subsidiaries could materially adversely affect our financial condition and results of operations.

Our operating results may be negatively impacted by the loss of certain tax benefits provided to companies in our industry by the governments of Belarus and other countries.

In Belarus, one local subsidiary is a member, along with other technology companies, of High-Technologies Park. Members have a full exemption from Belarus income tax and value added tax until 2049 and are taxed at reduced amounts on obligatory social contributions and a variety of other taxes. In Russia, our local subsidiary along with other qualified IT companies, benefit from paying obligatory social contributions to the government at a significantly reduced rate as well as an exemption from value added tax in certain circumstances. If these tax benefits are changed, terminated, not extended or comparable new tax incentives are not introduced, we expect that our operating expenses and/or our effective income tax rate could increase significantly, which could materially adversely affect our financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations - Provision for Income Taxes.”

14

Risks Related to Regulation and Legislation

Existing policy and substantial changes to fiscal, political, regulatory and other federal policies may adversely affect our business and financial results.

Changes in general economic or political conditions in the United States could adversely affect our business. U.S. policy with respect to a variety of issues, including international trade agreements, conducting business offshore, import and export regulations, tariffs and customs duties, foreign relations, immigration laws and travel restrictions, antitrust controls and enforcement, and corporate governance laws, could have a positive or negative impact on our business.

The majority of our professionals are offshore. Companies that outsource services to organizations operating in other countries remains a topic of political discussion in many countries, including the United States, which is our largest source of revenues. The United States Congress periodically proposes legislation that could impose restrictions on offshore outsourcing and on our ability to deploy employees holding U.S. work visas to customer locations, both of which could adversely impact our business. Such legislative measures could broaden restrictions on outsourcing by federal and state government agencies and contracts and impact private industry with tax disincentives, intellectual property transfer restrictions, and restrictions on the use or availability of certain work visas.

Some of our projects require our personnel to obtain visas to travel and work at customer sites outside of our personnel’s home countries and often in the United States. Our reliance on visas to staff projects with employees who are not citizens of the country where the work is to be performed makes us vulnerable to legislative and administrative changes in the number of visas to be issued in any particular year and other work permit laws and regulations. The process to obtain the required visas and work permits can be lengthy and difficult and variations due to political forces and economic conditions in the number of permitted applications, as well as application and enforcement processes, may cause delays or rejections when trying to obtain visas. Delays in obtaining visas may result in delays in the ability of our personnel to travel to meet with and provide services to our customers or to continue to provide services on a timely basis. In addition, the availability of a sufficient number of visas without significant additional costs could limit our ability to provide services to our customers on a timely and cost-effective basis or manage our sales and delivery centers as efficiently as we otherwise could. Delays in or the unavailability of visas and work permits could have a material adverse effect on our business, results of operations, financial condition and cash flows.

We are subject to laws and regulations in the United States and other countries in which we operate, including export restrictions, economic sanctions, the FCPA, and similar anti-corruption laws. Compliance with these laws requires significant resources and non-compliance may result in civil or criminal penalties and other remedial measures.

We are subject to many laws and regulations that restrict our international operations, including laws that prohibit activities involving restricted countries, organizations, entities and persons that have been identified as unlawful actors or that are subject to U.S. sanctions. The U.S. Office of Foreign Assets Control, or OFAC, and other international bodies have imposed sanctions that prohibit us from engaging in trade or financial transactions with certain countries, businesses, organizations and individuals. We are also subject to the FCPA and anti-bribery and anti-corruption laws in other countries, all of which prohibit companies and their intermediaries from bribing government officials for the purpose of obtaining or keeping business or otherwise obtaining favorable treatment. We operate in many parts of the world that have experienced government corruption to some degree, and, in certain circumstances, strict compliance with anti-bribery laws may conflict with local customs and practices, although adherence to local customs and practices is generally not a defense under U.S. and other anti-bribery laws.

Our compliance program contains controls and procedures designed to ensure our compliance with the FCPA, OFAC and other sanctions, and laws and regulations. The continuing implementation and ongoing development and monitoring of our compliance program may be time consuming, expensive, and could result in the discovery of compliance issues or violations by us or our employees, independent contractors, subcontractors or agents of which we were previously unaware.

Any violations of these or other laws, regulations and procedures by our employees, independent contractors, subcontractors and agents, including third parties we associate with or companies we acquire, could expose us to administrative, civil or criminal penalties, fines or business restrictions, which could have a material adverse effect on our results of operations and financial condition and would adversely affect our reputation and the market for shares of our common stock and may require certain of our investors to disclose their investment in us under certain state laws.

15

Risks Related to Our Industry and Customers

We generally do not have long-term commitments from our customers, our customers may terminate contracts before completion or choose not to renew contracts, and we are not guaranteed payment for services performed under contract. A loss of business or non-payment from significant customers could materially affect our results of operations.

Our ability to maintain continuing relationships with our major customers and successfully obtain payment for our services is essential to the growth and profitability of our business. However, the volume of work performed for any specific customer is likely to vary from year to year, especially since we generally are not our customers’ exclusive IT services provider and we generally do not have long-term commitments from customers to purchase our services. We may also fail to assess the creditworthiness of our customers adequately or accurately. Our customers’ ability to terminate engagements with or without cause and our customers’ inability or unwillingness to pay for services we performed makes our future revenues and profitability uncertain. Although a substantial majority of our revenues are generated from customers who also contributed to our revenues during the prior year, our engagements with our customers are typically for projects that are singular in nature. Therefore, we must seek to obtain new engagements when our current engagements end.

There are a number of factors relating to our customers that are outside of our control, which might lead them to terminate or not renew a contract or project with us, or be unable to pay us, including:

•financial difficulties;

•corporate restructuring, or mergers and acquisitions activity;

•our inability to complete our contractual commitments and invoice and collect our contracted revenues;

•change in strategic priorities or economic conditions, resulting in elimination of the impetus for the project or a reduced level of technology related spending;

•change in outsourcing strategy resulting in moving more work to the customer’s in-house technology departments or to our competitors; and

•replacement of existing software with packaged software supported by licensors.

Termination or non-renewal of a customer contract could cause us to experience a higher than expected number of unassigned employees and thus compress our margins until we are able to reallocate our headcount. Customers that delay payment, request modifications to their payment arrangements, or fail to meet their payment obligations to us could increase our cash collection time, cause us to incur bad debt expense, or cause us to incur expenses in collections actions. The loss of any of our major customers, a significant decrease in the volume of work they outsource to us or price they are willing or able to pay us, if not replaced by new service engagements and revenues, could materially adversely affect our revenues and results of operations.

Our revenues are highly dependent on a limited number of industries, and any decrease in demand for outsourced services in these industries could reduce our revenues and adversely affect our results of operations.

A substantial portion of our customers are concentrated in five specific industry verticals: Financial Services; Software & Hi-Tech; Business Information & Media; Travel & Consumer; and Life Sciences & Healthcare. Our business growth largely depends on continued demand for our services from customers in these five industry verticals and other industries that we target or may target in the future, and also depends on trends in these industries to outsource the type of services we provide.

A downturn in any of our targeted industries, a slowdown or reversal of the trend to outsource IT services in any of these industries or the introduction of regulations that restrict or discourage companies from outsourcing could result in a decrease in the demand for our services and could have a material adverse effect on our business, financial condition and results of operations. Other developments in the industries in which we operate may increase the demand for lower cost or lower quality IT services and decrease the demand for our services or increase the pressure our customers put on us to reduce pricing. We may not be able to successfully anticipate and prepare for any such changes, which could adversely affect our results of operations.

Furthermore, developments in the industries we serve could shift customer demand to new services, solutions or technology. If our customers demand new services, solutions or technologies, we may be less competitive in these new areas or may need to make significant investments to meet that demand. Additionally, as we expand into serving new industry verticals, our solutions and technology may be used by, or generally affect, a broader base of customers and end users, which may expose us to new business and operational risks.

If our pricing structures are based on inaccurate expectations and assumptions regarding the cost and complexity of performing our work, or if we are not able to maintain favorable pricing for our services, then our contracts could be unprofitable.

16

We face a number of risks when pricing our contracts and setting terms with our customers. Our pricing is highly dependent on our internal forecasts, assumptions and predictions about our projects, the marketplace, global economic conditions (including foreign exchange volatility) and the coordination of operations and personnel in multiple locations with different skill sets and competencies. Larger and more complex projects that involve multiple engagements or stages heighten those pricing risks because a customer may choose not to retain us for additional stages or delay forecasted engagements, which disrupts our planned project resource requirements. If our pricing for a project includes dedicated personnel or facilities and the customer were to slow or stop that project, we may not be able to reallocate resources to other customers. Our pricing and cost estimates for the work that we perform may include anticipated long-term cost savings that we expect to achieve and sustain over the life of the contract. Because of such inherent uncertainties, we may underprice our projects, fail to accurately estimate the costs of performing the work or fail to accurately assess the risks associated with potential contracts, such as defined performance goals, service levels, and completion schedules. The risk of underpricing our services or underestimating the costs of performing the work is heightened in fixed-price contracts and in contracts that require our customer to receive a productivity benefit as a result of the services performed under the contract. If we fail to accurately estimate the resources, time or quality levels required to complete such engagements, or if the cost to us of employees, facilities, or technology unexpectedly increases, we could be exposed to cost overruns. Any increased or unexpected costs, delays or failures to achieve anticipated cost savings, or unexpected risks we encounter in connection with the performance of the services, including those caused by factors outside our control, could make these contracts less profitable or unprofitable.

Our industry is sensitive to the economic environment and the industry tends to decline during general economic downturns. Given our significant revenues from North America and Europe, if those economies weaken, pricing for our services may be depressed and our customers may reduce or postpone their technology related spending significantly, which may in turn lower the demand for our services and negatively affect our revenues and profitability.

We face risks associated with having a long selling and implementation cycle for our services that require us to make significant resource commitments prior to realizing revenues for those services.

We have a long selling cycle for our services. Before potential customers commit to use our services, they require us to expend substantial time and resources educating them on the value of our services and our ability to meet their requirements. Therefore, our selling cycle is subject to many risks and delays over which we have little or no control, including our customers’ decision to select another service provider or in-house resources to perform the services, the timing of our customers’ budget cycles, and customer procurement and approval processes. If our sales cycle unexpectedly lengthens for one or more large projects, it could negatively affect the timing of our revenues and our revenue growth. In certain cases, we may begin work and incur costs prior to executing a contract, which may cause fluctuations in recognizing revenues between periods or jeopardize our ability to collect payment from customers.

Implementing our services also involves a significant commitment of resources over an extended period of time from both our customers and us. Our current and future customers may not be willing or able to invest the time and resources necessary to implement our services, and we may fail to close sales with potential customers despite devoting significant time and resources. Any significant failure to generate revenues or delays in recognizing revenues after incurring costs related to our sales or services processes could have a material adverse effect on our business.

If we are unable to adapt to rapidly changing technologies, methodologies and evolving industry standards, we may lose customers and our business could be materially adversely affected.

Rapidly changing technologies, methodologies and evolving industry standards are inherent in the market for our products and services. Our ability to anticipate developments in our industry, enhance our existing services, develop and introduce new services, provide enhancements and new features for our products, and keep pace with changes and developments are critical to meeting changing customer needs. Developing solutions for our customers is extremely complex and is expected to become increasingly complex and expensive in the future due to the introduction of new platforms, operating systems, technologies and methodologies. Our ability to keep pace with, anticipate or respond to changes and developments is subject to a number of risks, including that:

•we may not be able to develop new, or update existing services, applications, tools and software quickly or inexpensively enough to meet our customers’ needs;

•we may find it difficult or costly to make existing software and products work effectively and securely over the internet or with new or changed operating systems;

•we may find it challenging to develop new, or update existing software, services, and products to keep pace with evolving industry standards, methodologies, technologies, and regulatory developments in the industries where our customers operate at a pace and cost that is acceptable to our customers; and

•we may find it difficult to maintain high quality levels with new technologies and methodologies.

17

We may not be successful in anticipating or responding to these developments in a timely manner, or if we do respond, the services, products, technologies or methodologies we develop or implement may not be successful in the marketplace. Further, services, products, technologies or methodologies that our competitors develop may render our services or products non-competitive or obsolete. Our failure to enhance our existing services and products and to develop and introduce new services and products to promptly address the needs of our customers could have a material adverse effect on our business.

If we cause disruptions to our customers’ businesses, provide inadequate service, or breach contractual obligations, our customers may have claims for substantial damages against us and our reputation may be damaged. Our insurance coverage may be inadequate to protect us against such claims.

If our professionals make errors in the course of delivering services or we fail to meet contractual obligations to a customer, these errors or failures could disrupt the customer’s business or expose confidential or personally identifiable information. Any of these events could result in a reduction in our revenues, damage to our reputation, and could also result in a customer terminating our engagement and making claims for substantial damages against us. Some of our customer agreements do not limit our potential liability for occurrences such as breaches of confidentiality and intellectual property infringement indemnity, and we cannot generally limit liability to third parties with which we do not have a contractual relationship. In some cases, breaches of confidentiality obligations, including obligations to protect personally identifiable information, may entitle the aggrieved party to equitable remedies, including injunctive relief.

Although we maintain professional liability insurance, product liability insurance, cyber incident insurance, commercial general and property insurance, business interruption insurance, workers’ compensation coverage, and umbrella insurance for certain of our operations, our insurance coverage does not insure against all risks in our operations or all claims we may receive. Damage claims from customers or third parties brought against us or claims that we initiate due to the disruption of our business, information security systems, litigation, or natural disasters, may not be covered by our insurance, may exceed the limits of our insurance coverage, and may result in substantial costs and diversion of resources even if insured. Some types of insurance are not available on reasonable terms or at all in some countries in which we operate, and we cannot insure against damage to our reputation. The assertion of one or more large claims against us, whether or not successful and whether or not insured, could materially adversely affect our reputation, business, financial condition and results of operations.

18

A significant failure in our systems, telecommunications or IT infrastructure could harm our service model, which could result in a reduction of our revenues and otherwise disrupt our business.

Our service model relies on maintaining active voice and data communications, online resource management, financial and operational record management, customer service and data processing systems between our customer sites, our delivery centers and our customer management locations. Our business activities may be materially disrupted in the event of a partial or complete failure of any of these technologies, which could be due to software malfunction, computer virus attacks, conversion errors due to system upgrades, damage from fire, earthquake, power loss, telecommunications failure, unauthorized entry, government shutdowns, demands placed on internet infrastructure by growing numbers of users, increased bandwidth requirements or other events beyond our control. Our crisis management procedures, business continuity, and disaster recovery plans may not be effective at preventing or mitigating the effects of such disruptions, particularly in the case of a catastrophic event. Loss of all or part of the infrastructure or systems for a period of time could hinder our performance or our ability to complete customer projects on time which, in turn, could lead to a reduction of our revenues or otherwise materially adversely affect our business and business reputation.

Our ability to generate and retain business could depend on our reputation in the marketplace.

Our services are marketed to customers and prospective customers based on a number of factors, including reputation. Our corporate reputation is a significant factor in our customers’ evaluation of whether to engage our services. Our customers’ perception of our ability to add value through our services is critical to the profitability of our engagements. We believe the EPAM brand name and our reputation are important corporate assets that help distinguish our services from those of our competitors and contribute to our efforts to recruit and retain talented employees.

Our corporate reputation is potentially susceptible to damage by actions or statements made by current or former customers and employees, competitors, vendors, adversaries in legal proceedings, government regulators, as well as members of the investment community and the media. There is a risk that negative information about us, even if untrue, could adversely affect our business, could cause damage to our reputation and be challenging to repair, could make potential or existing customers reluctant to select us for new engagements, and could adversely affect our recruitment and retention efforts. Damage to our reputation could also reduce the value and effectiveness of the EPAM brand name and could reduce investor confidence in us.

We may not be able to prevent unauthorized use of our intellectual property, and our intellectual property rights may not be adequate to protect our business and competitive position.

We rely on a combination of copyright, trademark, patent, unfair competition and trade secret laws, as well as intellectual property assignment and confidentiality agreements and other methods to protect our intellectual property rights. Protection of intellectual property rights and confidentiality in some countries in which we operate may not be as effective as in other countries with more developed intellectual property protections.

We require our employees and independent contractors to assign to us all intellectual property and work product they create in connection with their employment or engagement. These assignment agreements also obligate our personnel to keep proprietary information confidential. If these agreements are not enforceable in any of the jurisdictions in which we operate, or are breached, we cannot ensure that we will solely own the intellectual property they create or that our proprietary information will not be disclosed. Our customers and certain vendors are generally obligated to keep our information confidential, but if these contractual obligations are not entered, or are breached or deemed unenforceable, our trade secrets, know-how or other proprietary information may be subject to unauthorized use, misappropriation or disclosure. Reverse engineering, unauthorized copying or other misappropriation of our and our customers’ proprietary technologies, tools and applications could enable unauthorized parties to benefit from our or our customers’ technologies, tools and applications without payment and may make us liable to our customers for damages and compensation, which could harm our business and competitive position.

We rely on our trademarks, trade names, service marks and brand names to distinguish our services and solutions from the services of our competitors. We have registered or applied to register many of these trademarks. Third parties may oppose our trademark applications, or otherwise challenge our use of our trademarks. In the event that our trademarks are successfully challenged, we could be forced to rebrand our services and solutions, which could result in loss of brand recognition, and could require us to devote additional resources to advertising and marketing new brands. Further, we cannot provide assurance that competitors will not infringe our trademarks, or that we will have adequate knowledge of infringement or resources to enforce our trademarks. If we do enforce our trademarks and our other intellectual property rights through litigation, we may not be successful and the litigation may result in substantial costs and diversion of resources and management attention.

19

We may face intellectual property infringement claims that could be time-consuming and costly to defend. If we fail to defend ourselves against such claims, we may lose significant intellectual property rights and may be unable to continue providing our existing services.

Our success largely depends on our ability to use and develop our technology, tools, code, methodologies, products, and services without infringing the intellectual property rights of third parties, including patents, copyrights, trade secrets and trademarks. We may be unaware of intellectual property rights relating to our products or services that may give rise to potential infringement claims against us. If those intellectual property rights are potentially relevant to our service offerings, we may need to license those rights in order to continue to use the applicable technology, but the holders of those intellectual property rights may be unwilling to license those rights to us on commercially acceptable terms, if at all. There may also be technologies licensed to and relied on by us that if subject to infringement or misappropriation claims by third parties, may become unavailable to us if such third parties obtain an injunction to prevent us from delivering our services or using technology involving the allegedly infringing intellectual property.

We typically indemnify customers who purchase our products, services and solutions against potential infringement of third-party intellectual property rights, which subjects us to the risk and cost of defending the underlying infringement claims. These claims may require us to initiate or defend protracted and costly litigation on behalf of our customers, regardless of the merits of these claims, and our indemnification obligations are often not subject to liability limits or exclusion of consequential, indirect or punitive damages. Intellectual property litigation could also divert our management’s attention from our business and existing or potential customers could defer or limit their purchase or use of our software product development services or solutions until we resolve such litigation. If any of these claims succeed, we may be forced to pay damages on behalf of our customers, redesign or cease offering our allegedly infringing products, services, or solutions, or obtain licenses for the intellectual property that such services or solutions allegedly infringe. If we cannot obtain all necessary licenses on commercially reasonable terms, our customers may be forced to stop using our services or solutions.

Any of these actions, regardless of the outcome of litigation or merits of the claim, could damage our reputation and materially adversely affect our business, financial condition and results of operations.

Risks Related to Information Security and Data Protection

Security breaches and other disruptions to network security could compromise our information and expose us to liability, which would cause our business and reputation to suffer.

In the ordinary course of business, we collect, store, process, transmit, and view sensitive or confidential data, including intellectual property, proprietary business information and personally identifiable information belonging to us, our customers, our respective employees, and other end users. This information is stored in our data centers and networks or in the data centers and networks of third-party providers. Physical security and the secure processing, maintenance and transmission of this information is critical to our operations and business strategy. Some of our customers seek additional assurances for the protection of their sensitive information, including personally identifiable information, and attach greater liability in the event that their sensitive information is disclosed. At times, to achieve commercial objectives, we may agree to greater liability exposure to our customers.

Individuals, including employees, contractors and other third parties in our information security supply chain, as well as groups and larger, sophisticated collections of hackers, such as state-sponsored organizations, all pose threats to our information security. These individual, group, and organized actors have a variety of methods at their disposal, including deploying malicious software, exploiting vulnerabilities in hardware, software, or infrastructure, using social engineering or deceptive techniques, and executing coordinated attacks to compromise our services, disrupt our operations or gain access to our networks and data centers.

20

Threats to information security evolve constantly and are increasingly sophisticated and complex, which makes detecting and successfully defending against them more difficult. Undetected vulnerabilities may persist in our network environment over long periods of time and could spread to the networks and systems of our suppliers and customers. We frequently update and improve our information security environment and assess and adopt new methods, devices, and technologies, but our policies and information security controls may not keep pace with emerging threats. We have in the past been subject to cyberattacks and expect to continue to be the target of malicious attacks. Despite our multiple security measures, any breach of our facilities, network, or information security defenses compromises the information stored in those locations and allows the accessed information to be held for ransom, publicly disclosed, misappropriated, lost or stolen. Such a breach, misappropriation, or disruption could also disrupt our operations and the services we provide to customers, damage our reputation, and cause a loss of confidence in our products and services, as well as require us to expend significant resources to protect against further breaches and to rectify problems caused by these events. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability under applicable laws, and regulatory penalties and could adversely affect our business, revenues and competitive position.

Development and deployment of measures to protect our information security or that of our customers may be inadequate and could adversely affect our results of operations.

To defend against information security threats internally, at our third-party providers, and on our customers’ systems, we must continuously engineer or purchase more secure products and services, enhance security and reliability features, improve deployment and compliance with software updates, assess and develop mitigation strategies and technologies to help secure information, hire information security specialists, and maintain a security infrastructure that protects our network, products, and services, and the software we build for our customers. We must also educate our employees, contractors, and customers about the need to effectively use security measures. Our customers, particularly those in the Financial Services and Life Sciences & Healthcare industry verticals, may have enhanced or particular security requirements which we must address in our engineering and development services.

The cost of information security measures, either to protect our information or the information of our customers, could reduce our profitability. Actual or perceived security vulnerabilities in our software and services, even if those vulnerabilities are the result of hardware or software developed by third parties, could harm our reputation and lead customers to use our competitors, reduce or delay future purchases of our services, or to seek compensation or damages.

Changes in privacy and data protection regulations could expose us to risks of noncompliance and costs associated with compliance.

EPAM is subject to the GDPR, the substantially similar U.K. GDPR, and the CCPA, each of which imposes significant restrictions and requirements relating to the processing of personal data. These and other state, national and international data protection laws that are or will soon be effective are more burdensome than historical privacy standards, especially in the United States. The CCPA , U.K. GDPR, and GDPR each established complex legal obligations that organizations must follow with respect to the processing of personal data, including a prohibition on the transfer of personal information to third parties or to other countries, and the imposition of additional notification, security and other control measures.

Enforcement actions taken by the European Union and U.K. data protection authorities, in the case of GDPR and U.K. GDPR, respectively, or by individuals or the California regulatory authorities, in the case of the CCPA, as well as audits or investigations by one or more individuals, organizations, or foreign government agencies could result in penalties and fines for non-compliance or direct claims against us in the event of any loss or damage as a result of a breach of these regulations. The burden of compliance with additional data protection requirements may result in significant additional costs, complexity and risk in our services and customers may seek to shift the potential risks resulting from the implementation of data privacy legislation to us. We are required to establish processes and change certain operations in relation to the processing of personal data as a result of GDPR, U.K. GDPR, and CCPA, which may involve substantial expense and distraction from other aspects of our business.

Undetected software design defects, errors or failures may result in loss of business or in liabilities that could materially adversely affect our business.

Our software development solutions involve a high degree of technological complexity, have unique specifications and could contain design defects or software errors that are difficult to detect or correct. Errors or defects may result in the loss of current customers, revenues, market share, or customer data, a failure to attract new customers or achieve market acceptance and could divert development resources and increase support or service costs. We cannot provide assurance that, despite testing by our customers and us, errors will not be found in the software products we develop or the services we perform. Any such errors could result in claims for damages against us, litigation, and reputational harm that could materially adversely affect our business.

21

General Risk Factors

Our stock price is volatile.

Our common stock has at times experienced substantial price volatility as a result of variations between our actual and anticipated financial results, announcements by our competitors, third parties, or us, projections or speculation about our business or that of our competitors or industry by the media or investment analysts, geopolitical events or uncertainty about inflation or other current global economic conditions. The stock market, as a whole, also has experienced price and volume fluctuations that have affected the market price of many technology companies in ways that may have been unrelated to these companies’ operating performance. Furthermore, we believe our stock price should reflect future growth and profitability expectations and, if we fail to meet these expectations, our stock price may significantly decline.

Expense related to our liability-classified restricted stock units, which are subject to mark-to-market accounting, and the calculation of the weighted-average diluted shares outstanding in accordance with the treasury method are both affected by our stock price. Any fluctuations in the price of our stock will affect our future operating results.

We may need additional capital, and a failure to raise additional capital on terms favorable to us, or at all, could limit our ability to grow our business and develop or enhance our service offerings to respond to market demand or competitive challenges.

We believe that our current cash, cash flow from operations and expanded revolving line of credit are sufficient to meet our anticipated cash needs for at least the next twelve months. We may, however, require additional cash resources due to changed business conditions or other future developments, including any investments or acquisitions that we may decide to pursue. If these resources are insufficient to satisfy our cash requirements, we may seek to sell additional equity or debt securities or obtain another credit facility, and we cannot be certain that such additional financing would be available on terms acceptable to us or at all. The sale of additional equity securities could result in dilution to our stockholders, and additional indebtedness would result in increased debt service costs and obligations and could impose operating and financial covenants that would further restrict our operations.

Our hedging program is subject to counterparty default risk.

We enter into foreign currency forward contracts with a number of counterparties. As a result, we are subject to the risk that the counterparty to one or more of these contracts defaults on its performance under the contract. During an economic downturn, the counterparty’s financial condition may deteriorate rapidly and with little notice and we may be unable to take action to protect our exposure. In the event of a counterparty default, we could incur significant losses, which may harm our business and financial condition. In the event that one or more of our counterparties becomes insolvent or files for bankruptcy, our ability to eventually recover any losses suffered as a result of that counterparty’s default may be limited by the liquidity of the counterparty.

War, terrorism, other acts of violence or natural or man-made disasters may affect the markets in which we operate, our customers, and our service delivery.

Our business may be negatively affected by instability, disruption or destruction in the geographic regions where we operate. War, terrorism, riot, civil insurrection or social unrest; man-made and natural disasters, the severity and frequency of which have increased due to climate change, and include famine, flood, fire, earthquake, pandemics and other regional or global health crises, storm or disease, may cause customers to delay their decisions on spending for the services we provide and give rise to sudden significant changes in regional and global economic conditions and cycles. Our crisis management procedures, business continuity, and disaster recovery plans may not be effective at preventing or mitigating the effects of such disasters, particularly in the case of simultaneous or catastrophic events. These events pose significant security risks to our people, the facilities where they work, our operations, electricity and other utilities, communications, travel, and network services, and the disruption of any or all of them could materially adversely affect our financial results. Travel restrictions resulting from natural or man-made disruptions and political or social conflict increase the difficulty of obtaining and retaining highly-skilled and qualified professionals and could unexpectedly increase our labor costs and expenses, both of which could also adversely affect our ability to serve our customers.

22

Our effective tax rate could be materially adversely affected by several factors.

We conduct business globally and file income tax returns in multiple jurisdictions. Our effective tax rate could be materially adversely affected by several factors, including changes in the amount of income taxed by or allocated to the various jurisdictions in which we operate that have differing statutory tax rates; changing tax laws, regulations and interpretations of such tax laws in one or more jurisdictions; and the resolution of issues arising from tax audits or examinations and any related interest or penalties. The determination of our provision for income taxes and other tax liabilities requires estimation, judgment and calculations where the ultimate tax determination may not be certain. Our determination of tax liability is always subject to review or examination by authorities in various jurisdictions. If a tax authority in any jurisdiction reviews any of our tax returns and proposes an adjustment, including, but not limited to, a determination that the transfer prices and terms we have applied are not appropriate, such an adjustment could have a negative impact on our results of operations, business, and profitability. In addition, any significant changes enacted by the current U.S. presidential administration to the Tax Cuts and Jobs Act (“U.S. Tax Act”) enacted in 2017, or to regulatory guidance associated with the U.S. Tax Act, could materially adversely affect our effective tax rate.