What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-11-05 compared with 2025-08-07 · 87 added, 81 removed, 927 unchanged (15% of the section changed)

101 unchanged sentences

If our relationship with Pathward terminates, or if Pathward were to suspend, limit, or cease its operations or loan origination activities for any reason, and we are unable to engage another originating bank partner on a timely basis or at all, our business, results of operations and financial condition would be materially and adversely affected.*

As of June 30, 2025, we relied on Pathward, N.A., or Pathward, to originate a substantial portion of our loan originations, with the remaining loans being originated directly by us under our lending and servicing licenses across 3 states in the United States.

In the three months ended June 30, 2025 and 2024, Pathward originated approximately 97% and 98% of aggregate personal loan originations, respectively.

Our previous Pathward program agreement had an initial term of five years, which was scheduled to expire in August 2025.

The agreement would have automatically renewed for an additional two years following the initial five-year term, unless either party provided notice.

In February 2025, we notified Pathward of our desire to continue the relationship pursuant to certain revised terms and in August 2025, we entered into an amended and restated program agreement with Pathward, which replaced the prior agreement in its entirety and governs the ongoing terms of our relationship.

As of September 30, 2025, we relied on Pathward, N.A., or Pathward, to originate a substantial portion of our loan originations, with the remaining loans being originated directly by us under our lending and servicing licenses across 2 states in the United States.

In the three months ended September 30, 2025 and 2024, Pathward originated approximately 99% and 97% of aggregate personal loan originations, respectively.

In August 2025, we entered into an amended and restated program agreement, as amended, to extend our partnership with Pathward through 2029, which replaced the prior agreement in its entirety and governs the ongoing terms of our relationship.

The amended and restated program agreement has an initial term of four years and will automatically renew for successive two-year periods following the initial four-year term, unless either party provides notice of its intent to not renew.

Under the current arrangement, Pathward retains a proportion of the loans they originate on their own balance sheet, and sells the remainder of the loans to us, which we in turn sell to institutional investors, sell to our warehouse trust special purpose entities, or retain on our balance sheet.

The amended and restated program agreement includes a post-closing provision requiring the parties to negotiate in good faith to determine whether Pathward will continue retaining loans they originate and to agree on the handling, transition, or disposition of Pathward's existing retained loan portfolio.

If the parties do not reach agreement within six months following the effective date of the amended and restated program agreement, Pathward will cease retaining new loans under the program as of that date.

There can be no assurance that the parties will reach agreement on a long-

term retention structure or that the transition of Pathward’s retention rights, if required, will not result in adverse operational, financial, or business-related impacts.

In addition, even during the term of our arrangement and for specified circumstances, Pathward could reduce the volume of loans that it chooses to originate and/or retain on its balance sheet.

We or Pathward may terminate our arrangement immediately upon a material breach by the other party and failure to cure such breach within a cure period, if any representations or warranties are found to be false and such error is not cured within a cure period, bankruptcy or insolvency of either party, receipt of an order or judgment by a governmental entity, a material adverse effect, or a change of control.

If our bank partnership arrangement with Pathward were to be suspended or limited, or if Pathward ceased their operations or otherwise terminated their relationship with us, our business, financial condition and results of operations would be adversely affected.

If we need to enter into alternative arrangements with a different bank to replace our existing arrangement, we may not be able to negotiate a comparable alternative arrangement in a timely manner or at all and transitioning loan originations to a new bank may result in delays in the issuance of new loans.

In addition, if we are unable to enter into an alternative arrangement with a different bank to fully replace or supplement our relationship with Pathward, we would potentially need to obtain additional state licenses to enable us to originate loans directly in the states where Pathward originates loans, as well as comply with other state and federal laws, which would be costly and time consuming, and there can be no assurances that any such licenses could be obtained in a timely manner or at all.

If our bank partnership arrangement with Pathward were to be suspended or limited, including a reduction in the volume of loans that Pathward chooses to originate, or if Pathward ceased their operations or otherwise terminated their relationship with us, our business, financial condition and results of operations would be adversely affected.

If we need to enter into alternative arrangements with a different bank to replace or supplement our existing arrangement, we may not be able to negotiate a comparable alternative arrangement in a timely manner or at all and transitioning loan originations to a new bank may result in delays in the issuance of new loans.

In addition, if we are unable to enter into an alternative arrangement with a different bank to fully

replace or supplement our relationship with Pathward, we would potentially need to obtain additional state licenses to enable us to originate loans directly in the states where Pathward originates loans, as well as comply with other state and federal laws, which would be costly and time consuming, and there can be no assurances that any such licenses could be obtained in a timely manner or at all.

For a further discussion of the risks and regulations applicable to our bank partnership with Pathward, see “Risk Factors—Our bank partnership products may lead to regulatory risk and may increase our regulatory burden, —We are, and intend in the future to continue, expanding into new geographic regions, and our failure to comply with applicable laws or regulations, or accurately predict demand or growth, related to these geographic regions could have an adverse effect on our business, —Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability.”

4 unchanged sentences

In particular, it is important that we continue to ensure that our members with loans remain loyal to us and we continue to extend loans to members who have successfully repaid their previous loans.

As of June 30, 2025 and 2024, members with repeat loans comprised 77% and 82%, respectively, of our Owned Principal Balance at End of Period.

As of September 30, 2025 and 2024, members with repeat loans comprised 76% and 81%, respectively, of our Owned Principal Balance at End of Period.

If our repeat loan rates decline, we may not realize consistent or improved operating results from our existing member base.

9 unchanged sentences

We use estimates and assumptions in determining the fair value of our loans receivable held for investment and asset-backed notes.

Our Loans Receivable at Fair Value represented 86% of our total assets and our asset-backed notes represented 79% of our total liabilities as of June 30, 2025.

Our Loans Receivable at Fair Value represented 87% of our total assets and our asset-backed notes represented 85% of our total liabilities as of September 30, 2025.

The fair value of our loans receivable held for investment are determined using Level 3 inputs and the fair value of our asset-backed notes are determined using Level 2 inputs.

7 unchanged sentences

Financial institutions and other funding sources provide us with the capital to fund a substantial portion of the principal amount of our loans to members and charge us interest on funds that we borrow.

In the event that the spread between the interest rate at which we lend to our members and the rate at which we borrow from our lenders

decreases, our Net Revenue will decrease.

In the event that the spread between the interest rate at which we lend to our members and the rate at which we borrow from our lenders decreases, our Net Revenue will decrease.

We have capped the APR for newly originated loans at 36% since August 2020.

3 unchanged sentences

Factors outside our control, including interest rate changes and widening credit spreads, have required, and may continue to require us to make adjustments to the fair value of our loans receivable held for investment or our asset-backed notes, which may in turn adversely affect our results of operations or lead to volatility in our Net Revenue.

For example, elevated interest rates decrease the fair value of our loans receivable held for investment, which decreases Net Revenue, but also decreases the fair value of our asset-backed notes, which increases Net Revenue.

For example, elevated interest rates decrease the fair value of our loans receivable held

for investment, which decreases Net Revenue, but also decreases the fair value of our asset-backed notes, which increases Net Revenue.

Because the duration and fair value of our loans and asset-backed notes are different, the respective changes in fair value may not fully offset each other resulting in a negative impact on Net Revenue and increasing the volatility of our results of operations.

6 unchanged sentences

Many of these factors are outside our control and include:

general economic conditions or outlook, unemployment levels, housing markets, immigration patterns and policies, gas prices, energy costs, tariffs and other non-tariff trade barriers, inflation, government shutdowns, delays in tax refunds, financial distress caused by recent or potential bank failures, volatility or disruption in the capital markets, changes in interest rates, and other macroeconomic circumstances as well as events such as natural disasters, acts of war, terrorism, public health outbreaks or adverse health developments, political instability, social unrest, and catastrophes.

general economic conditions or outlook, unemployment levels, housing markets, immigration patterns and policies, including enforcement practices, gas prices, energy costs, tariffs and other non-tariff trade barriers, inflation, government shutdowns, delays in tax refunds, financial distress caused by recent or potential bank failures, volatility or disruption in the capital markets, changes in interest rates, and other macroeconomic circumstances as well as events such as natural disasters, acts of war, terrorism, public health outbreaks or adverse health developments, political instability, social unrest, and catastrophes.

For example, uncertainty as to the impact of the imposition of tariffs or other restrictions on certain countries by the current U.S.

2 unchanged sentences

has recently experienced historically high levels of inflation, which may increase our expenses and adversely impact our borrowers' ability to make payments on their loans.

Increased interest rates have had, and may continue to have, an adverse impact on the spending levels of consumers and their ability and willingness to borrow money.

Increased interest rates have also had, and may continue to have, an adverse impact on the spending levels of consumers and their ability and willingness to borrow money.

Higher interest rates often lead to higher payment obligations, which may reduce the ability of consumers to remain current on their obligations and, therefore, lead to increased delinquencies, defaults, consumer bankruptcies and charge-offs, and decreasing recoveries, all of which could have an adverse effect on our business.

2 unchanged sentences

We recorded a net loss of $78.7 million for the year ended December 31, 2024, primarily due to a net decrease in fair value and increased cost of debt, and we recorded a net loss of $180.0 million for the year ended December 31, 2023, primarily due to a net decrease in fair value and increased cost of debt.

Our business was adversely impacted by the COVID-19 pandemic and we recorded a net loss of $45.1 million for the year ended December 31, 2020.

We also experienced net losses prior to 2017.

14 unchanged sentences

Decreases in consumer demand for automobiles and declining values of vehicles securing outstanding secured personal loans would weaken collateral coverage for secured personal loans and increase the amount of loss in the event of default.

Significant increases in the inventory of used

vehicles may also depress the prices at which repossessed vehicles may be sold or delay the timing of these sales.

Significant increases in the inventory of used vehicles may also depress the prices at which repossessed vehicles may be sold or delay the timing of these sales.

Consequently, if a vehicle securing a secured personal loan is repossessed while the used car auction market is depressed, the sale proceeds for such vehicle may be lower than expected, resulting in higher than expected losses.

36 unchanged sentences

Additionally, the use of A.I.

is relatively new and the regulatory

framework is evolving and remains uncertain.

is relatively new and the regulatory framework is evolving and remains uncertain.

Any negative regulatory or public scrutiny based upon this could adversely affect our business and reputation.

2 unchanged sentences

We are therefore limited in our ability to collect on these loans if a member is unwilling or unable to repay them for any reason.

We currently act as servicer with respect to the unsecured and secured consumer loans, by our bank partners, and for parties to whom we have sold our loans, including the loans that are sold as part of whole loan sales, contributed to asset-backed securitizations, and pledged in connection with warehouse credit facilities.

with warehouse credit facilities.

Our ability to adequately service our loans is dependent on our ability to maintain appropriate staffing levels and sufficiently train new member services and collections staff, contact our members when they default, and leverage technologies to service and collect amounts owed with respect to loans.

60 unchanged sentences

or imposing obligations in connection with its use, including by addressing forms of automated decision-making.

For example, on September 23, 2025, the California Privacy Protection Agency’s regulations under the California Consumer Privacy Act (“CCPA”), which address, among other matters, obligations for businesses that use automated decision-making for “significant decisions” about California consumers, were approved.

These regulations become effective January 1, 2026, with phased compliance deadlines relating to automated decision-making commencing in 2027.

The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the Gramm-Leach-Bliley Act (“GLBA”).

In some cases, these laws also contain broader exemptions for entities, such as financial institutions, that are subject to the GLBA;

however, these exemptions may not exempt us completely from these laws, and their scope and interpretation remain subject to uncertainty.

It is likely that new laws and regulations will be adopted, or existing laws and regulations may be interpreted in new ways, that would affect our business, products and services and the way in which we use A.I., including with respect to fair lending laws.

Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving laws, regulations, and industry standards.

Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving laws, regulations, and industry standards, and we may be required to implement substantial changes to our processes and procedures, and to incur substantial costs, to make these adaptations.

If we are unable to do so in a timely or cost-effective manner, our business could be harmed.

14 unchanged sentences

If there are changes in the laws affecting any of our products, or our marketing and servicing, or if we become subject to such investigations, enforcement actions and lawsuits, our financial condition and results of operations would be adversely affected.

into new products, as well as into the banking business or new origination channels, such as bank partnerships, and other partnerships, could lead to negative publicity or draw additional scrutiny.

Entry into new products, as well as into the banking business or new origination channels, such as bank partnerships, and other partnerships, could lead to negative publicity or draw additional scrutiny.

Harm to our reputation can also arise from many other sources, including employee or former employee misconduct, misconduct by outsourced service providers or other counterparties, failure by us or our partners to meet minimum standards of service and quality, and inadequate protection of member information and compliance failures and claims.

5 unchanged sentences

Many of the companies with which we compete for experienced employees have greater resources than we have and may be able to offer more attractive terms of employment.

For example, changes to U.S.

immigration policies, particularly to H-1B and other visa programs, and restrictions on travel could restrain the flow of technical and professional talent into the U.S.

and may inhibit our ability to hire qualified personnel.

In particular, employee candidates, specifically in high-technology industries, often consider the value of any equity they may receive in connection with their employment, so significant volatility or a further decline in the price of our stock may adversely affect our recruitment strategies.

62 unchanged sentences

For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities and such security systems may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations.

Techniques used in cybersecurity attacks to obtain unauthorized access, disable or sabotage information technology systems change frequently, as

data breaches and other cybersecurity events have become increasingly commonplace, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts in Ukraine and the Middle East.

We have seen, and will continue to see, industry-wide vulnerabilities, which could affect our or other parties’ systems.

Techniques used in cybersecurity attacks to obtain unauthorized access, disable or sabotage information technology systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts in Ukraine and the Middle East.

We have seen, and will

continue to see, industry-wide vulnerabilities, which could affect our or other parties’ systems.

We also have incorporated A.I.

65 unchanged sentences

Further, the concentration of our outstanding receivables in one or more states would have a disproportionate effect on us if governmental authorities in any of those states take action against us or take action affecting how we conduct our business.

As of June 30, 2025, 37.1%, 25.9%, 10.8%, 5.8% and 4.1% of our Owned Principal Balance at End of Period related to members from California, Texas, Florida, Illinois and New Jersey, respectively.

As of September 30, 2025, 35.3%, 25.4%, 11.2%, 5.9% and 4.2% of our Owned Principal Balance at End of Period related to members from California, Texas, Florida, Illinois and New Jersey, respectively.

If any of the events noted in these risk factors were to occur in or have a disproportionate impact in regions where we operate or plan to commence operations, it may negatively affect our business in many ways, including increased delinquencies and loan losses or a decrease in future originations.

2 unchanged sentences

If we are unable to access certain third-party data used in our credit risk models, or our access to such data is limited through new regulation or otherwise, our ability to accurately evaluate potential members will be compromised, and we may be unable to effectively predict probable credit losses inherent in our loan portfolio, which would negatively impact our results of operations.

Third-party data sources, including credit bureau data and other alternative data sources, are

aggregated by our risk engine to be used in our credit risk models to score applicants, make credit decisions, and in our verification processes to confirm member-reported information.

If the information that we receive from third parties about a member is inaccurate or does not accurately reflect the member’s creditworthiness, this may cause us to provide loans to higher risk members than we intended through our underwriting process and/or inaccurately price the loans we make.

Third-party data sources, including credit bureau data and other alternative data sources, are aggregated by our risk engine to be used in our credit risk models to score applicants, make credit decisions, and in our verification processes to confirm member-reported information.

and/or inaccurately price the loans we make.

In addition, this information may not always be complete, up-to-date or properly evaluated.

30 unchanged sentences

In 2024, following the bankruptcy of a fintech platform, regulators have expanded expectations for third-party oversight by banks engaged in bank partnership programs.

If regulators conclude that our bank partners have not met the heightened standards for oversight of their third-party service providers, any resulting regulatory action could have an adverse effect on their ability to fulfill their contractual obligations to us which could adversely effect our business, financial condition and results of operations.

If regulators conclude that our bank partners have not met the heightened standards for oversight of their third-party service providers, any resulting regulatory action could have an adverse effect on their ability to fulfill their contractual obligations to us which could adversely affect our business, financial condition and results of operations.

In some cases, third-party vendors are the sole source, or one of a limited number of sources, of the services they provide to us.

2 unchanged sentences

For a further discussion of the risks applicable to our partnership with Pathward, see “Risk Factors—We currently rely on Pathward to originate a substantial portion of our loans.

If our relationship with Pathward terminates, or if Pathward were to suspend, limit, or cease its operations or loan origination activities for any reason, and

we are unable to engage another originating bank partner on a timely basis or at all, our business, results of operations and financial condition would be materially and adversely affected.”

Our mission to provide inclusive, affordable financial services that empower our members to build a better future may conflict with the short-term interests of our stockholders or may not provide the long-term benefits that we expect and may adversely impact our business operations, results of operations, and financial condition.

13 unchanged sentences

In certain areas where we operate, there is significant competition for hourly bilingual employees and the lack of availability of an adequate number of hourly bilingual employees could adversely affect our operations.

In addition, we are subject to applicable rules and regulations relating to our relationship with our employees, including minimum wage and break requirements, pay transparency, leave requirements, health benefits, unemployment and sales taxes, overtime and working conditions and immigration status.

We are from time to time subject to employment-related claims, including wage and hour claims.

6 unchanged sentences

Our international operations involve inherent risks which could result in harm to our business.

As of June 30, 2025, we had 1,494 employees in Mexico, including employees related to our two contact centers.

As of September 30, 2025, we had 1,560 employees in Mexico, including employees related to our two contact centers.

These employees provide certain English/Spanish bilingual support related to member-facing contact center activities, administrative and technology support of the contact centers and back-office support services.

In addition, we have a technology development center in India, where we had 204 employees as of June 30, 2025.

In addition, we have a technology development center in India, where we had 216 employees as of September 30, 2025.

We have also previously engaged vendors that utilized employees or contractors based outside of the U.S.

13 unchanged sentences

Violations of the complex foreign and U.S.

laws, rules and regulations that apply to our international operations and offshore activities of our service providers may result in reputational harm, heightened regulatory scrutiny, fines, criminal actions or sanctions against us, our directors or our employees, as well as restrictions on the conduct of our business.

laws, rules and regulations that apply to our international operations and offshore activities of our service providers may result in reputational harm, heightened regulatory scrutiny, fines, criminal actions or sanctions against us, our officers, our directors or our employees, as well as restrictions on the conduct of our business.

If we discover a material weakness in our internal control over financial reporting that we are unable to remedy or otherwise fail to maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to report our financial results on a timely and accurate basis and the market price of our common stock may be adversely affected.

21 unchanged sentences

For example, during parts of the COVID-19 pandemic, we temporarily closed a few of our retail locations due to public health orders or other concerns, which we believe resulted in lower Aggregate Originations.

While all of our retail locations are currently open, it is possible that we will have to temporarily close retail locations as necessary due to public health orders or other concerns relating to any public health crisis.

While all of our retail locations are currently open, it is possible

that we will have to temporarily close retail locations as necessary due to public health orders or other concerns relating to any public health crisis.

The closure of retail locations could further adversely affect our loan originations, member experience, results of operations and financial condition.

14 unchanged sentences

Even if we adequately address the issues raised by an investigation or proceeding or successfully defend a third-party lawsuit or counterclaim, we may have to devote significant financial and management resources to address these issues.

Health epidemics or other outbreaks, such as the COVID-19 pandemic, may adversely impact our business and results of operations.

Health epidemics or other outbreaks may adversely impact our business and results of operations.*

Our business could be adversely impacted by the effects of health epidemics or other outbreaks.

For example, the COVID-19 pandemic and health and safety measures taken by governments and private industry in response to the COVID-19 pandemic significantly impacted worldwide economic activity and consumer behavior and created economic uncertainty.

Worker shortages, supply chain issues, inflationary pressures, vaccine and testing requirements, the emergence of new health epidemics or outbreaks and new variants of COVID-19, and the reinstatement and subsequent lifting of restrictions and health and safety related measures in response to the emergence of new health epidemics or outbreaks and new variants of COVID-19 have occurred in the past and may occur in the future.

We are unable to predict the future path or impact of any global or regional health epidemics, other outbreaks, or resurgences of COVID-19, including existing or future variants.

An extended period of disruption as a result of a health epidemic or public health outbreaks, including COVID-19, may negatively impact us, as well as our members, vendors, and partners.

Worker shortages, supply chain issues, inflationary pressures, vaccine and testing requirements, the emergence of new health epidemics or outbreaks, and the reinstatement and subsequent lifting of restrictions and health and safety related measures in response to the emergence of new health epidemics or outbreaks have occurred in the past and may occur in the future.

We are unable to predict the future path or impact of any global or regional health epidemics or other outbreaks.

An extended period of disruption as a result of a health epidemic or public health outbreaks may negatively impact us, as well as our members, vendors, and partners.

Funding and Liquidity Risks

40 unchanged sentences

If collections were insufficient to repay the amounts due under our securitizations and our revolving debt facilities, the applicable lenders, trustees and noteholders could seek remedies, including against the collateral pledged under such facilities.

Any of these events would negatively impact our liquidity, including our ability to originate new loans, and require us to rely on alternative funding sources.

Any of these events would negatively impact our liquidity, including our ability to

originate new loans, and require us to rely on alternative funding sources.

If we were unable to arrange new or alternative methods of financing on favorable terms, we might have to curtail the origination of loans, and we may be replaced by our back-up servicer or another successor servicer.

33 unchanged sentences

Potential loan purchasers might reduce the premiums they are willing to pay, or even require a discount to principal balance, for the loans that they purchase during periods of economic slowdown or recession to compensate for any increased risks.

A reduction in the sale price of the loans we sell under any future whole loan

sale program would likely result in a reduction in the fair value of our Loans Receivable at Fair Value, which would negatively impact our results of operations.

A reduction in the sale price of the loans we sell under any future whole loan sale program would likely result in a reduction in the fair value of our Loans Receivable at Fair Value, which would negatively impact our results of operations.

Any sustained decline in demand for our loans or increase in delinquencies, defaults or foreclosures may reduce the price we receive on future loan sales below our loan origination cost.

42 unchanged sentences

In addition, although in some cases a third party may have agreed to indemnify us for such costs, such indemnifying party may refuse or be unable to uphold its contractual obligations.

In other cases, our

insurance may not cover potential claims of this type adequately or at all, and we may be required to pay monetary damages, which may be significant.

In other cases, our insurance may not cover potential claims of this type adequately or at all, and we may be required to pay monetary damages, which may be significant.

Our credit risk models, A.I.

42 unchanged sentences

It could also result in a default or early amortization event under certain of our debt facilities and reduce or terminate availability of debt financing to us to fund originations.

To the extent it is determined that any loan we make was not originated in accordance with all applicable laws as we are required to represent under our securitization and other debt facilities and in loan sales to investors, we could be obligated to repurchase for cash or swap for qualifying assets, any such loan determined not to have been originated in compliance with legal requirements.

To the extent it is determined that any loan we make was not originated

in accordance with all applicable laws as we are required to represent under our securitization and other debt facilities and in loan sales to investors, we could be obligated to repurchase for cash or swap for qualifying assets, any such loan determined not to have been originated in compliance with legal requirements.

We may not have adequate liquidity and resources to make such cash repurchases or swap for qualifying assets.

8 unchanged sentences

Additionally, platforms offering banking services and products through partners have also been challenged by federal and state regulators on a variety of claims.

Regulatory bodies may enact new laws or promulgate new regulations or view matters or interpret laws and regulations differently than they have in the past, or commence investigations or inquiries into our business practices.

For example, in April 2022, the CFPB announced that it intends to examine nonbank financial companies that pose risks to consumers, and in November 2022, the Treasury Department issued a report encouraging the CFPB to increase its supervisory activity with respect to larger nonbank lenders.

Regulatory bodies may enact new laws or promulgate new regulations or view matters or interpret existing laws and regulations differently than in the past, or commence investigations or inquiries into our business practices.

For example, in April 2022, the CFPB announced that it intended to examine non-bank financial companies that pose risks to consumers, and in November 2022, the Treasury Department issued a report encouraging the CFPB to increase its supervisory activity with respect to larger non-bank lenders.

Since then, the CFPB has further modified its non-bank supervisory procedures (including in November 2022 and April 2024) and in September 2025 issued a final rule (effective October 27, 2025) that reinstates key pre-2022 procedural protections and signals a narrowing of the category of non-bank entities that may be designated for supervision.

As a result, while the CFPB retains its supervisory authority over non-banks and could subject us to its supervisory process, the mechanics, scope and thresholds of that supervision are evolving, meaning regulatory scrutiny may move in either direction.

If the CFPB decides to subject us to its supervisory process, it could significantly increase the level of regulatory scrutiny of our business practices.

It is unclear whether or the extent to which the CFPB's position will change under the Trump administration and the extent to which the government’s focus on enforcement of federal consumer protection laws will change.

It is possible that the CFPB could promulgate rules and bring enforcement actions that materially impact our business.

The direction of CFPB policy and enforcement priorities may continue to shift under future administrations or leadership, creating ongoing uncertainty regarding the interpretation and enforcement of federal consumer protection laws.

Accordingly, the CFPB could promulgate rules, adopt different interpretations, or bring enforcement actions that materially impact our business.

Our involvement in any such matter could cause harm to our reputation and divert management attention from the operation of our business, even if the matters are ultimately determined in our favor.

12 unchanged sentences

If any of those factors were to cause any loans, or any of the terms of the loans, to be unenforceable against the borrowers, or impair our ability to service our loans, the value of our loan assets would decrease significantly to us and to our whole loan purchasers, securitization investors and warehouse lenders.

In addition to increased default rates and losses on our loans, this could lead to the loss of whole loan purchasers and

securitization investors and trigger terminations and amortizations under our debt warehouse facilities, each of which would materially adversely impact our business.

In addition to increased default rates and losses on our loans, this could lead to the loss of whole loan purchasers and securitization investors and trigger terminations and amortizations under our debt warehouse facilities, each of which would materially adversely impact our business.

The CFPB has broad authority to regulate consumer financial services, creating uncertainty as to how the agency’s actions or the actions of any other new agency could impact our business.

19 unchanged sentences

We collect, store, use, disclose, and otherwise process a large volume of personal information about individuals (including members and employees).

New laws and regulations concerning the processing of personal information continue to be vigorously debated and enacted at all levels of government across the United States and around the globe while existing laws, such as the Gramm-Leach-Bliley Act, are being amended or reinterpreted to account for the rapidly evolving data economy.

The California Consumer Privacy Act (the “CCPA”), as augmented and otherwise amended by the California Privacy Rights Act of 2020, imposes significant requirements on businesses processing consumer personal information – principally around enabling and honoring consumer choices related to such processing.

Violations of the CCPA can result in civil penalties assessed by the Attorney General or the California Privacy Protection Agency and individual plaintiffs may pursue statutory damages in a private right of action for certain data breaches.

states have already followed California’s lead in enacting comprehensive privacy legislation and others are likely to do so in the future.

The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the Gramm-Leach-Bliley Act.

In some cases, these laws also contain broader exemptions for entities such as Oportun that are subject to the Gramm-Leach-Bliley Act.

These exemptions may not exempt Oportun completely from these laws, however, and such exemptions’ scope and interpretation remain subject to uncertainty.

New laws and regulations concerning the processing of personal information continue to be vigorously debated and enacted at all levels of government across the United States and around the globe while existing laws, such as the GLBA, are being amended or reinterpreted to account for the rapidly evolving data economy.

The CCPA, as augmented and otherwise amended by the California Privacy Rights Act of 2020, imposes significant requirements on businesses processing consumer personal information, principally around enabling and honoring consumer choices related to such processing.

Regulations under the CCPA have now been finalized addressing, among other matters, the use of automated decision-making technology (“ADMT”) in “significant decisions”.

The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the GLBA.

In some cases, these laws also contain broader exemptions for entities, such as financial institutions, that are subject to the GLBA;

however, these exemptions may not exempt us completely from these laws, and their scope and interpretation remain subject to uncertainty.

Further, future laws may not include such exemptions.

In addition, the California Privacy Protection Agency has begun coordinating with state attorneys general to enhance enforcement and policy development around privacy and artificial intelligence, underscoring that A.I.

governance remains a priority area of focus for both state and federal regulators.

Violations of the CCPA can result in civil penalties assessed by the California Attorney General or the California Privacy Protection Agency and individual plaintiffs may pursue statutory damages in a private right of action for certain data breaches.

states have already followed California’s lead in enacting comprehensive privacy legislation and others are likely to do so in the future.

These developments reflect the continued evolution of state privacy regulation and the potential for expanding obligations on businesses that use consumer data.

At the federal level, regulators, including the CFPB and FTC, have adopted, or are considering adopting, laws and regulations concerning personal information and data privacy and security.

The FTC, for example, released its updated Standards for Safeguarding Customer Information (Safeguards Rule), effective June 9, 2023, which raises the bar for covered financial institutions’ information security programs through proscriptive requirements for things like accountability and oversight, performing risk assessments, encryption, and enabling multi-factor authentication to protect all forms of customer information.

The FTC, for example, released its updated Standards for Safeguarding Customer Information (Safeguards Rule), effective June 9, 2023, which raises the bar for covered financial institutions’ information security programs through proscriptive requirements for accountability, oversight, risk assessments, encryption, and multi-factor authentication to protect all forms of customer information.

Further, on October 22, 2024, the CFPB finalized the Section 1033 Rule on Personal Financial Data Rights, which requires certain financial institutions, and any party who controls or possesses information concerning a covered financial product or service, to provide financial data to consumers in a standardized electronic format through a consumer interface and limits collecting and maintaining data only as necessary to carry out transactions a consumer requests, prohibiting use of any information for targeted or behavioral advertising.

The final rule has been challenged in the Eastern District Court of Kentucky.

On July 29, 2025, the Eastern District of Kentucky issued an Order granting the stay of litigation requested by the CFPB while it works to promulgate a new rule implementing Section 1033 of Dodd-Frank.

At this time the substance of the new rule is unknown and it is possible it could adversely affect our business.

On July 29, 2025, the Eastern District of Kentucky issued an Order granting the stay of litigation requested by the CFPB while it works to promulgate a new rule-making process to revise the rule’s scope, definitions and timing.

Compliance deadlines remain in place for now, but the ultimate obligations could change materially.

At this time the substance and timing of the revised rule is uncertain, and it is possible it could adversely affect our business.

federal government also is contemplating federal privacy legislation.

This patchwork of legislation and regulation may give rise to conflicts or differing views of personal privacy rights and of privacy, data protection, and security obligations to which companies such as Oportun must adhere.

The rapidly evolving regulatory environment relating to privacy, data protection, and cybersecurity, along with increased scrutiny from consumers and their advocates and increased complexity in Oportun’s organizational structure, demands careful attention to our own processing of personal information and processing by third parties acting on our behalf.

This patchwork of state and federal legislation and regulation may give rise to conflicts or differing views of personal privacy rights and of privacy, data protection, and security obligations to which we must adhere .

The rapidly evolving regulatory environment relating to privacy, data protection, and cybersecurity, along with increased scrutiny from consumers and their advocates and increased complexity in our organizational structure, demands careful attention to our own processing of personal information and processing by third parties acting on our behalf.

For example, we’ve seen an increase in third-party arrangements, including, for example, with lead aggregators, bank partners, Lending as a Service partners and affiliate relationships.

Our failure, or any failure by

third parties with whom we do business, to comply with applicable laws or regulations or contractual obligations required by our business partners relating to privacy, data protection, or cybersecurity, and even a perceived failure, could damage our reputation, harm our ability to obtain market adoption, discourage existing and prospective members from using our products and services, require us to change our business practices, business partners or operational structure, or result in investigations, claims, or fines by governmental agencies and private plaintiffs, and other liabilities.

Our failure, or any failure by third parties with whom we do business, to comply with applicable laws or regulations or contractual obligations required by our business partners relating to privacy, data protection, or cybersecurity, and even a perceived failure, could damage our reputation, harm our ability to obtain market adoption, discourage existing and prospective members from using our products and services, require us to change our business practices, business partners or operational structure, or result in investigations, claims, or fines by governmental agencies and private plaintiffs, and other liabilities.

Even in the absence of a challenge to our practices, we may incur substantial costs to implement new systems to comply with regulatory requirements, such as consumer requests concerning the processing of their personal information and to honor any choices that may be available to them by law.

29 unchanged sentences

persons such as employees and contractors, as well as third-party vendors and consultants engaged to support our business activities.

In all cases, the sharing of software and/or technology is solely for the internal use of the company or for the use by business partners to provide services to us, including software development.

In all cases, the sharing of software and/or

technology is solely for the internal use of the company or for the use by business partners to provide services to us, including software development.

However, such shipments and transfers may be subject to U.S.

and foreign regulations governing the export and import of goods, software and technology.

If we fail to comply with these laws and regulations, we and certain of our employees could be subject to significant sanctions, fines,

penalties and reputational harm.

If we fail to comply with these laws and regulations, we and certain of our employees could be subject to significant sanctions, fines, penalties and reputational harm.

Further, any change in applicable export, import or economic sanctions regulations or related legislation, shift in approach to the enforcement or scope of existing regulations or change in the countries, persons or technologies targeted by these regulations could adversely affect our business.

5 unchanged sentences

The issuance of shares of our Common Stock upon exercise of our outstanding warrants issued in connection with our Corporate Financing, would increase the number of shares eligible for future resale in the public market and result in dilution to our stockholders.

As of June 30, 2025, warrants to purchase 2,682,788 shares of our Common Stock issued in connection with our Corporate Financing, remain outstanding and exercisable.

As of September 30, 2025, warrants to purchase 2,682,788 shares of our Common Stock issued in connection with our Corporate Financing, remain outstanding and exercisable.

The exercise price of these warrants is $0.01 per share.

45 unchanged sentences

Such proposed changes, as well as regulations and legal decisions interpreting and applying these changes, may have significant impacts on our effective tax rate, cash tax expenses and net deferred taxes in the future.

However, on June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two.

However, on June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system that would exempt U.S.-parented multinationals from certain provisions of Pillar Two;

however, no agreement regarding implementation of the proposal has been reached yet.

We will continue to monitor legislative and regulatory developments to assess the potential impacts that Pillar Two and any retaliatory taxes or actions may have on our business, operating results and financial condition.

12 unchanged sentences

Other limitations may also apply under state law.

For example, in June 2024, California enacted legislation that limits the use of state net operating loss carryforwards and tax credits for tax years beginning on or after January 1, 2024, and before January 1, 2027.

For example, California legislation limits the use of state net operating loss carryforwards and tax credits for tax years beginning on or after January 1, 2024, and before January 1, 2027.

As a result of this legislation or other unforeseen reasons, we may not be able to utilize some or all of our net operating loss carryforwards and tax credits, even if we attain profitability.

10 unchanged sentences

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Act, the listing standards of the Nasdaq Stock Market, and other applicable securities rules and regulations, including with regard to corporate governance practices and the establishment and maintenance of effective disclosure and financial controls.

Compliance with these rules and regulations increases our legal and financial compliance costs, makes some activities more difficult, time-consuming or costly and increases demand on our systems and resources.

Compliance with these rules and regulations increases

our legal and financial compliance costs, makes some activities more difficult, time-consuming or costly and increases demand on our systems and resources.

In addition, changing laws, regulations and standards or interpretations thereof relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time-consuming.

50 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors