monday.com (MNDY) F-1/ARegistration statement (foreign) (amended)

As used in this prospectus, unless the context otherwise requires, references to “we,” “us,” “our,” “our business,” the “Company,” “monday.com” and similar references refer to monday.com Ltd. and, where appropriate, its consolidated subsidiaries.

We have incurred significant net losses in each year since our inception, including net losses of $91.6 million, $152.2 million, $19.9 million and $39.0 million in the years ended December 31, 2019 and 2020 and the three months ended March 31, 2020 and 2021, respectively. In addition, we expect to continue to incur net losses for the foreseeable future, and we may not achieve or maintain profitability in the future. Because the market for our platform and the features, integrations, capabilities and enhancements we offer is rapidly evolving and has not yet reached widespread adoption, it is difficult for us to predict our future results of operations or the limits of our market opportunity. We expect our

To encourage awareness, use, familiarity and adoption of our platform and products, we recently began offering a "Free plan" geared to small teams that provides free access for up to two users to certain features of our Work OS. This strategy may not be successful in driving potential customers to purchase subscriptions to our Work OS. Users of our Free plan may not lead to others within their organization purchasing and deploying our Work OS. To the extent that users do not become paying customers after subscribing to our Free plan, we will not realize the intended benefits of these marketing strategies and our revenue growth may be adversely affected.

We rely on the internet and, accordingly, depend upon the continuous, reliable and secure operation of internet servers, related hardware and software, and network infrastructure. We host our

The secure storage, transmittal and processing of sensitive and proprietary information, including business strategies, financial and operational data, personal or identifying information and other related data, by users and organizations on our platform is essential to their use of our Work OS. Increasingly, companies are subject to a wide variety of attacks on their systems on an ongoing basis. In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee theft or misuse, password spraying, phishing, credential stuffing and denial-of-service attacks, we also face threats from sophisticated organized crime, nation-state and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions). Third parties may attempt to fraudulently induce employees, users or organizations into disclosing sensitive information such as usernames, passwords or other information or otherwise compromise the security of our internal electronic systems, networks, and/or physical facilities in order to gain access to our data or the data of users and organizations on our platform. Additionally, there is an increased risk that we may experience cybersecurity-related events such as COVID-19-themed phishing attacks and other security challenges as a result of most of our employees and our service providers working remotely from non-corporate-managed networks during the ongoing COVID-19 pandemic and potentially beyond. Security breaches impacting our Work OS or integrations on our Work OS could result in a risk of loss, unavailability, or unauthorized disclosure of this information, which, in turn, could lead to litigation, governmental audits, investigations and possible liability (including regulatory fines), thereby damaging

Actual or anticipated security breaches or attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Furthermore, any such breach, including a breach of the systems or networks of our third-party providers, could compromise our systems or networks, creating system outages, disruptions or slowdowns and exploiting security vulnerabilities of our networks. In addition, the information stored on our network or the networks of our third-party providers could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm. In addition, a breach of the security measures of one of our third-party providers could result in the destruction, modification or exfiltration of confidential corporate information or other data that may provide additional avenues of attack. These breaches, or any perceived breach, of our systems or networks or the systems or networks of our third-party providers, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in us or our industry and result in damage to our reputation, negative publicity, loss of users, partners and sales, increased remediation costs, and costly litigation or regulatory fines. For example, we recently became aware that a third-party vendor that provides us with SaaS software code testing, Codecov, discovered instances of unauthorized access to its software, whereby a threat actor was able to export information stored in continuous integration environments, affecting hundreds of companies using their services, including us. Although investigations remain ongoing, as of the date of this prospectus, we have not seen any indication that our customers’ data was affected by this incident. The attacker did access a file containing a list of certain URLs pointing to publicly broadcasted customer forms and views hosted on our platform and we have contacted the relevant customers to inform them how to regenerate these URLs. We also found evidence that a read-only copy of our source code was accessed due to the Codecov vulnerability. However, as of the date of this prospectus, we found no evidence of any unauthorized modifications to our source code nor any impact on our products. However, the discovery of new or different information regarding the Codecov cyberattack, including with respect to its scope and any potential impact on our IT environment, including regarding the loss, inadvertent disclosure or unapproved dissemination of proprietary information or sensitive or confidential data about us or our customers, or vulnerabilities in our source code, could result in litigation and potential liability for us, damage our brand and reputation, negatively impact our sales or otherwise harm our business. Any claims or investigations may result in our incurring significant external and internal legal and advisory costs, as well as the diversion of management's attention from the operation of our business.

In addition to the GDPR, following the United Kingdom’s departure from the EU, we became subject to a similar legal regime in the United Kingdom by virtue of its national legislation that imposes similar obligations to the GDPR (the “UK GDPR”), which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g., fines up to the greater of €20 million (£17 million) or 4% of global turnover. The relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear and it is unclear how UK data protection laws or regulations will develop in the medium to longer term and how EU data transfers to and from the United Kingdom will be regulated in the long term. Currently there is up to a six month grace period ended June, 30 2021 while the parties discuss adequacy; however it is not clear whether (and when) an adequacy decision may be granted by the European Commission enabling data transfers from EU member states to the United Kingdom long term without additional measures. These changes will lead to additional costs and increase our overall risk exposure.

We are also subject to evolving EU privacy laws on cookies and e-marketing. In the EU, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive are highly likely to be replaced by an EU-regulation known as the ePrivacy Regulation, which will significantly increase fines for non-compliance. In the EU, informed consent is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing, unless certain limited exceptions or alternatives apply. The GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents

We may be required to spend significant resources to monitor and protect our intellectual property rights, and we may or may not be able to detect infringement, misappropriation or other violations of our intellectual property rights by third parties. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management, may not ultimately be resolved in our favor, and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. If we are unable to protect our intellectual property rights or prevent unauthorized use, infringement or misappropriation thereof by third parties, the

From time to time, there have been claims challenging both the ownership of open source software against companies that incorporate open source software into their products and whether such

We rely on our trademarks, trade names and brand names to distinguish our Product Solutions from the products of our competitors, and have registered or applied to register many of these. However, occasionally third parties may have already registered identical or similar marks for products or

The trading market for our ordinary shares will rely in part on the research and reports that equity research analysts publish about us and our business. The analysts’ estimates are based upon their own opinions and are often different from our estimates or expectations. If our results of operations are below the estimates or expectations of public market analysts and investors, the price of our ordinary shares could decline. Moreover, the price of our ordinary shares could decline if one or more securities

As a foreign private issuer, we have the option to follow certain home country corporate governance practices rather than those of Nasdaq, provided that we disclose the requirements we are not following

As a public company, and particularly after we are no longer an emerging growth company, we will incur significant legal, accounting and other expenses that we did not incur as a private company. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform, the Consumer Protection Act, the listing

Many members of our management team have limited experience managing a publicly traded company, interacting with public company investors and complying with the increasingly complex laws pertaining to public companies. Our management team may not successfully or efficiently manage our transition to being a public company subject to significant regulatory oversight and reporting obligations under the federal securities laws and the continuous scrutiny of securities analysts and investors. These new obligations and constituents will require significant attention from our senior management and

In addition, many Israeli citizens are obligated to perform several days, and in some cases more, of annual military reserve duty each year until they reach the age of 40 (or older, for reservists who are

The monday Foundation is charged with helping us carry out our Equal Impact Initiative, which is guided by our ambitious social responsibility mission. Due to the intended scale and the desired impact of our Equal Impact Initiative, the monday Foundation will require additional capital to fund its operations and meet the Equal Impact Initiative’s desired goals. We anticipate that part of this financing will be in the form of issuances of our equity and equity-linked securities, including ordinary shares and warrants exercisable for ordinary shares.

Following the closing of this offering, we intend to fund the monday Foundation by issuing it a warrant to purchase 778,500 ordinary shares, with an exercise price of $0.01 per ordinary share. Commencing two or more years following the closing of this offering, and for a period of approximately ten years, we intend to issue additional ordinary shares or warrants exercisable for ordinary shares to the monday Foundation in order to continue to fund its charitable initiatives to promote the Equal Impact Initiative, in an amount not to exceed 1% of our outstanding ordinary shares on an annual basis, measured as of the end of each fiscal year, with any unissued amount up to such 1% carried over to subsequent fiscal years. As of the date of this prospectus, we have not determined the amount of ordinary shares and/or warrants exercisable for ordinary shares that will be issued to the monday Foundation, as such decision will largely depend on the funding requirements and performance of the monday Foundation on an ongoing basis. The issuance of equity and equity-linked securities to the monday Foundation, including ordinary shares and warrants exercisable for ordinary shares, will result in substantial dilution to our current shareholders’ ownership and may be limited by the number of shares we have authorized and available for issuance.

During weak economic times, there is an increased risk that one or more of our paying customers will file for bankruptcy protection, which may harm our revenue and results of operations. We also face risk from international paying customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict. In

In addition, we use third parties to sell access to our Work OS and conduct business on our behalf abroad. We or such current and future third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities, and, in certain circumstances, we could be held liable for the corrupt or other illegal activities of our third-party intermediaries even if we do not explicitly authorize such activities. We have implemented an anti-corruption compliance program and have controls in place with respect to our third-party relationships,

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based upon information available to us as of the date of this prospectus, and while we believe such information forms a reasonable basis for such statements,

We expect that our issuance of equity and equity-linked securities to the monday Foundation, including ordinary shares and warrants exercisable for ordinary shares, will result in dilution to our existing shareholders’ ownership over time. While we are under no legal requirement to fund or continue to fund the monday Foundation, our Co-Chief Executive Officers are committed to doing so for the

The monday Foundation will operate independently from the Company, and the Company will have no direct control over the affairs of the monday Foundation. As such, the monday Foundation may not operate as intended, which could adversely impact us. See “Risk Factors — Risks Related to our Equal Impact Initiative and the monday Foundation” — The novelty of our Equal Impact Initiative makes its efficacy unpredictable and makes us susceptible to unintended consequences.”