What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-12 compared with 2024-03-15 · 46 added, 46 removed, 27 unchanged (77% of the section changed)

3 unchanged sentences

Risk Management and Strategy

Our information security policies and processes

are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security and confidentiality

of consumer information.

We use various tools and strategies to identify and assess material risks from cybersecurity threats.

ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing.

The cybersecurity risk assessments,

vulnerability testing, and penetration testing are designed to identify internal and external risks to the security of our information

We also actively monitor our systems and connections

for abnormal activity, including malicious phishing attempts.

This includes the use of intrusion detection systems, log analysis, and

real-time monitoring of critical systems.

We have an incident reporting portal available to all employees to submit any issues they suspect

may pose a risk to our information technology (“IT”) systems and security.

We use the results of the above-described tools

and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity threats, to enhance such

safeguards, or implement new safeguards, as necessary.

We have several safeguards in place to manage material risks from cybersecurity

Our information security policies

and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security

and confidentiality of consumer information.

We use various tools and strategies to identify and assess material risks from cybersecurity

We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing.

The cybersecurity

risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security

of our information systems.

We also actively monitor our

systems and connections for abnormal activity, including malicious phishing attempts.

This includes the use of intrusion detection systems,

log analysis, and real-time monitoring of critical systems.

We have an incident reporting portal available to all employees to submit

any issues they suspect may pose a risk to our information technology (“IT”) systems and security.

We use the results of the

above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity

threats, to enhance such safeguards, or implement new safeguards, as necessary.

We have several safeguards in place to manage material

risks from cybersecurity threats.

We have security awareness training for our employees, including ongoing simulated phishing email campaigns.

We utilize firewalls,

anti-virus software, encryption on stored data and communication channels, secure web portals for remote access to our systems, password

security, and two-factor authentication.

We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access

to our systems, password security, and two-factor authentication.

We continuously update our software and security patches.

We restrict inbound email attachments,

certain websites, and cloud-based drives.

We monitor and restrict information transfers to and from unauthorized IP addresses.

have physical security safeguards for our locations and data centers.

inbound email attachments, certain websites, and cloud-based drives.

We monitor and restrict information transfers to and from unauthorized

IP addresses.

We also have physical security safeguards for our locations and data centers.

We back up our systems and data regularly.

In addition, we have

a disaster recovery program designed to help us quickly respond to and recover from an interruption of critical IT services.

As part of our overall risk management processes,

we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments as needed, including

IT, Systems, Risk Management, and Legal.

We engage assessors, consultants, auditors, or other third parties to assist with some of the

processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability testing, and

penetration testing.

To oversee and identify material cybersecurity risks associated with our use of third-party service providers, we

limit data access for third-party service providers to only the data that is necessary for the given function and conduct due diligence

on our service providers including their information security practices.

We require our service providers to maintain appropriate safeguards

for the security of consumer information.

We cannot assure that our information security

policies and processes will be effective in protecting us from cybersecurity threats.

Risks from cybersecurity threats have not materially

However, if we experience a material cybersecurity incident it is reasonably likely to materially affect us, including our

business strategy, results of operations, or financial condition.

In addition, we have a disaster recovery program designed to help us respond to and recover from an interruption of critical IT services.

As part of our overall risk

management processes, we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments

as needed, including IT, Systems, Risk Management, and Legal.

We engage assessors, consultants, auditors, or other third parties to assist

with some of the processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability

testing, and penetration testing.

To oversee and identify material cybersecurity risks associated with our use of third-party service

providers , we limit data access for third-party service providers to only the data that is necessary for the given function and conduct

due diligence on our service providers including their information security practices.

We require our service providers to maintain appropriate

safeguards for the security of consumer information.

We cannot assure that our

information security policies and processes will be effective in protecting us from cybersecurity threats.

Risks from cybersecurity threats

have not materially affected us.

However, if we experience a material cybersecurity incident it is reasonably likely to materially affect

us, including our business strategy, results of operations, or financial condition.

For more information, please see Item 1A.

Risk Factors of this Report,

including the risk factors titled “If We Experience Problems with Our Originations, Accounting or Collection Systems, Our Results

of Operations May Be Impaired” and “A Breach in the Security of Our Systems Could Result in the Disclosure of Confidential

Information, or Subject us to Liability.”

of this Report, including the risk factors titled “If We Experience Problems with Our Originations, Accounting or Collection Systems,

Our Results of Operations May Be Impaired” and “A Breach in the Security of Our Systems Could Result in the Disclosure of

Confidential Information, or Subject us to Liability.”

The Senior Vice President

18 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments