What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-17 compared with 2025-02-24 · 618 added, 453 removed, 1171 unchanged (48% of the section changed)

12 unchanged sentences

Business, Financial and Operational Risks

• our ability to successfully identify and address the risks and uncertainties we face, particularly with respect to certain rapidly evolving industries;

• our ability to successfully identify and address the risks and uncertainties we face, particularly with respect to certain rapidly evolving industries, including digital asset and blockchain innovations, and with respect to continued expansion abroad;

• demands on our resources, intense and increasing competition, and the success of our business model;

• legislative and regulatory policies and related actions that apply or may apply to us, particularly as a result of our operating a bank and as a bank holding company, in connection with student loans, given our brokerage and investment advisory activity, or related to services provided by our technology platform;

• loss of one or more significant purchasers of our loans or one or more significant technology platform clients;

• legislative and regulatory policies and related actions that apply or may apply to us, particularly as a result of our operating a bank and as a bank holding company, in connection with our digital asset and blockchain offerings and student loans, from our continued expansion abroad, given our brokerage and investment advisory activity, or related to services provided by our technology platform;

• loss of one or more significant purchasers of our loans or additional significant technology platform clients;

• adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties;

1 unchanged sentence

• failure of third-party service providers or systems on which we rely or, in the event we move certain services or systems in-house, our ability to successfully perform those services or implement and operate those systems;

• cyberattacks and other security breaches that may harm our brand and reputation and the expense of which may stress our resources;

Risks Related to Market and Interest Rates

3 unchanged sentences

• an inability to maintain a competitive annual percentage yield on deposits could cause members to transfer checking and savings account balances to our competitors;

SoFi Technologies, Inc.

Risks Related to Strategic and New Products

• potential and past acquisitions that require significant attention could disrupt our business and adversely affect our financials;

SoFi Technologies, Inc.

• we may fail to innovate or respond to evolving technological or other changes;

7 unchanged sentences

• the failure of our third-party service providers to perform functions related to the origination and servicing of loans;

• financial issues or liquidity issues experienced by our technology platform clients could result in termination of, or inability to pay for, their services;

• financial issues or liquidity issues experienced by our technology platform clients could result in termination of, or inability to pay for, the services we provide;

Risks Related to Funding and Liquidity

• our ability to retain, increase or secure new or alternative financing, including through deposits, to finance our business and the receivables that we originate or other assets that we hold;

• termination of one or more of our warehouse facilities on which we are highly dependent;

• termination of one or more of our warehouse facilities;

• our ability to sell the loans we originate to third parties;

• increases in member loan default rates or the possibility of being required to retain or repurchase loans or indemnify the purchasers of our loans;

• increases in member loan default rates or the possibility of being required to repurchase loans or indemnify the purchasers of our loans;

Regulatory, Tax and Other Legal Risks

• our exposure to evolving laws, rules, regulations and government enforcement policies, and potential enforcement actions, litigation, investigations, exams or inquiries or impairment of licenses;

• our ability to effectively mitigate risk exposure;

• changes in business, economic or political conditions;

10 unchanged sentences

Risk Management and Financial Reporting Risks

• our ability to establish and maintain proper and effective internal control over financial reporting and risk management processes and procedures;

• our ability to effectively mitigate risk exposure;

• our ability to establish and maintain proper and effective internal control over risk management processes and procedures and financial reporting;

SoFi Technologies, Inc.

• adjustments to our key business metrics, including adjustments to the total number of members or products in the event a member is removed in accordance with our terms of service which may not be reflected in the current period;

• changes in accounting principles generally accepted in the United States;

SoFi Technologies, Inc.

• incorrect estimates or assumptions by management in connection with the preparation of our financial statements;

2 unchanged sentences

• cyberattacks and other security breaches or disruptions of our systems or third-party systems on which we rely, including our cloud computing services arrangement, disruptions that may impact our ability to collect loan payments and maintain accurate accounts, or our ability to provide services to our technology platform clients;

• cyber breaches or intrusions, including successful social engineering attacks, such as phishing, that imperil the confidential information of our members, prospective members, technology platform clients and the customers of our technology platform clients, and employees and third-party service providers, and may harm our reputation and brand;

• technology challenges related to the collection, processing, use, storage and transmission of personal data;

• liabilities related to the data, models, and use of artificial intelligence in products or business processes;

• liabilities related to the data, models, and use of artificial intelligence (“AI”) in products or business processes;

Risks Related to Ownership of Our Securities

5 unchanged sentences

We operate in rapidly evolving industries which may make it difficult to successfully identify risks to our business and evaluate our future prospects.

In addition, in recent years, we have rapidly expanded our operations to include or expand, among other things, deposit accounts, credit cards, investment services, technology solutions, home loan originations, small business financing solutions, loan platform business solutions, alternative investments, and international operations, and we have limited experience in these areas.

In addition, in recent years, we have rapidly expanded our operations to include or grow, among other things, deposit accounts, credit cards, investment services, technology solutions, home loan originations, small business financing solutions, loan platform business solutions, alternative investments, digital asset and blockchain innovations, and international operations, and we have limited experience in these areas.

In the first quarter of 2022, we acquired a bank charter and face risks as a result of our lack of experience operating a bank and as a bank holding company.

2 unchanged sentences

In 2024, we adopted our Technology Platform’s Cyberbank Core in connection with the launch of a commercial payment services sponsor bank program.

In 2025, SoFi Bank launched SoFi Crypto in the U.S., and SoFi Securities (Hong Kong) Limited launched crypto trading in Hong Kong, giving members the ability to buy, sell and hold digital assets, and we launched self-serve global remittance services in over thirty countries, allowing SoFi members to seamlessly and securely transfer money internationally.

In addition, in 2025, SoFi Bank launched SoFi Smart Card, a charge card secured by the member’s SoFi Money checking and savings Account, to SoFi Plus members.

In addition to the events above, we face numerous challenges to our success, including our ability to:

• increase or maintain the number, volume and types of, and add new features to, the loans we extend to our members as the market for loans evolves and as we face new and increasing competitive threats;

• successfully integrate our past and future acquisitions, including continuing to develop Wyndham’s technology, performing functions in home loans origination, such as home loans processing and underwriting, and managing the origination of new home loan types;

• successfully integrate our past and future acquisitions;

• increase the number of members utilizing our non-lending products, including our direct deposit feature, and maintain and build on the loyalty of existing members by increasing their use of new or additional products;

1 unchanged sentence

• successfully maintain and enhance our diversified funding strategy, including through deposits, securitization financing from consolidated and nonconsolidated VIEs, whole loan sales, and debt warehouse facilities;

• further establish, diversify and refine our checking and savings, credit card, investment and brokerage offerings to meet evolving consumer needs and preferences;

SoFi Technologies, Inc.

• further establish, diversify and refine our checking and savings, credit card, investment and brokerage offerings to meet evolving consumer needs and preferences, such as the introduction of products based on digital asset and blockchain innovations and the SoFi Smart Card;

• offer an attractive annual percentage yield on our deposits compared to our competitors and manage deposit costs;

1 unchanged sentence

• favorably compete as a service provider with other companies and banks, including traditional and alternative technology-enabled lenders, financial service providers, broker-dealers, social media and other commerce platforms and applications that offer peer-to-peer, in-app and social commerce payment capabilities, and technology platform;

SoFi Technologies, Inc.

• continue to realize the benefits of operating a bank;

• introduce new products or other offerings, as well as new or improved technologies, to meet the needs of our existing and prospective members or to keep pace with competitive lending, checking and savings, credit card, investment, technology and other developments;

• introduce new products or other offerings, as well as new or improved technologies, to meet the needs of our existing and prospective members and clients or to keep pace with competitive lending, checking and savings, credit card, investment, technology, including digital asset, blockchain and AI innovations, and other developments;

• successfully navigate the evolving regulatory environment for digital assets and blockchain technology;

• maintain or increase the effectiveness of our direct marketing and other sales and marketing efforts, and maintain our brand;

12 unchanged sentences

• successfully continue to expand internationally;

• adequately respond to macroeconomic and other exogenous challenges, including fluctuating interest rates, market volatility, particularly in the financial services industry, changes in consumer confidence, consumer discretionary spending and loan delinquency rates, pandemics or other health-related crises, escalating conflict in the Middle East, the ongoing war in Ukraine, and significant changes related to governmental policy, rules and regulations or executive actions;

• adequately respond to macroeconomic and other exogenous challenges, including fluctuating interest rates, market volatility, particularly in the financial services industry, changes in consumer confidence, consumer discretionary spending and loan delinquency rates, pandemics or other health-related crises, the confrontation in Venezuela, the ongoing conflict in the Middle East, the ongoing war in Ukraine, and significant changes related to governmental policy, rules and regulations or executive actions;

• maintain successful relationships with our governmental regulatory agencies and law enforcement authorities, as well as self-regulatory agencies;

4 unchanged sentences

We may incur net losses in the future, and any such losses may fluctuate significantly from quarter to quarter.

We will need to continue to generate and sustain significant revenues for our business generally and achieve greater scale and generate increasing operating cash flows from our Financial Services segment, in particular, in future periods, as well as successfully navigate the macroeconomic environment, in order to maintain or increase our level of profitability.

We will need to continue to generate and sustain significant revenues

SoFi Technologies, Inc.

for our business generally and achieve greater scale and generate increasing operating cash flows from our Financial Services and Technology Platform segments, in particular, in future periods, as well as successfully navigate the macroeconomic environment, in order to maintain or increase our level of profitability.

We intend to continue to invest in new products and businesses, which has in the past and may in the future cause us to fund and operate aspects of our business at a loss.

We also intend to continue to invest in sales and marketing, technology, and additional products and services in order to enhance our brand, our brand recognition and our value proposition to our members, prospective members and clients in our technology platform business, and these additional costs will create further challenges to maintaining or increasing near-term profitability.

We also intend to continue to invest in sales and marketing, technology, and additional products and services in order to enhance our brand, our brand recognition and our value proposition to our members, prospective members and clients in our technology platform business, and these continued investments and costs could create further challenges to maintaining or increasing profitability.

Our general and administrative expenses have in the past and may in the future increase to meet the increased compliance and other requirements associated with operating as a public company and a bank holding company, operating a bank, and evolving regulatory requirements and policy changes.

See “ Regulatory, Tax and Other Legal Risks — As a bank holding company, we are subject to extensive supervision and

SoFi Technologies, Inc.

regulation, and changes in laws and regulations applicable to bank holding companies could limit or restrict our activities and could have a material adverse effect on our operations ”.

See “ Regulatory, Tax and Other Legal Risks — As a bank holding company, we are subject to extensive supervision and regulation, and changes in laws and regulations applicable to bank holding companies could limit or restrict our activities and could have a material adverse effect on our operations ”.

We are continuously refining our revenue and business model, which is premised on creating a virtuous cycle for our members to engage with more products across our platform, a strategy we refer to as the Financial Services Productivity Loop, and, with respect to our Technology Platform segment, adoption by clients of additional platform as a service offerings.

4 unchanged sentences

Our rapid growth in certain areas of our business in recent years, primarily within our Financial Services and Technology Platform segments, as well as operating a bank and as a bank holding company, has placed significant demands on our operational, risk management, sales and marketing, technology, compliance, and finance and accounting infrastructure, and has resulted in increased expenses, a trend that we expect to continue as our business grows.

In addition, we are required to continuously develop and adapt our systems and infrastructure in response to the increasing sophistication of the consumer financial services market, changing technologies, evolving fraud, privacy and information security landscape, and regulatory developments, both domestically and internationally, relating to our existing and projected business activities.

In addition, we are required to continuously develop and adapt our systems and infrastructure in response to the increasing sophistication of the consumer financial services market, changing technologies, an evolving fraud, privacy and information security landscape, and regulatory developments, both domestically and internationally, relating to our existing and projected business activities.

Our future growth will depend on, among other things, our ability to maintain an operating platform and management system able to address such growth, our ability to grow and optimize deposit balances, and our ongoing ability to demonstrate to our regulators that our risk management and compliance practices are growing and evolving in a commensurate fashion, all of which has required, and we expect will continue to require, us to incur significant additional expenses, expand our workforce and commit additional time from senior management and operational resources.

8 unchanged sentences

We expect our competition to continue to increase, as there are no substantial barriers to entry to certain of the markets we serve.

Some of our current and potential competitors have longer operating histories, particularly with respect to our financial services products, significantly greater financial, technical, marketing and other resources, and a larger customer base than we do.

Certain of our current and potential competitors have longer operating histories, particularly with respect to our financial services products, including digital asset and blockchain offerings, significantly greater financial, technical, marketing

SoFi Technologies, Inc.

and other resources, and a larger customer base than we do.

This allows them to potentially offer more competitive pricing or other terms or features, a broader range of financial products, or a more specialized set of specific products or services, as well as respond more quickly than we can to new or emerging technologies and changes in member preferences.

In addition to established enterprises, we may also face competition from early-stage companies attempting to capitalize on the same, or similar, opportunities as we are.

In addition to established enterprises, we may also face competition from early-stage companies, or companies in industries not typically associated with financial services, such as social media and other commerce platforms, attempting to capitalize on the same, or similar, opportunities as we are.

Our existing or future competitors may develop products or services that are similar to our products and services or that achieve greater market acceptance than our products and services.

1 unchanged sentence

Additionally, when new competitors seek to enter our markets, or when existing market participants seek to increase their market share, these competitors sometimes undercut, or otherwise exert pressure on, the pricing terms prevalent in that market, which could adversely affect our market share and/or our ability to capitalize on market opportunities.

SoFi Technologies, Inc.

We currently compete at multiple levels with a variety of competitors, including:

5 unchanged sentences

• social media and other commerce platforms and applications that offer peer-to-peer, in-app and social commerce payment capabilities;

• other digital asset and global remittance service providers for our SoFi Crypto and self-serve global remittance products;

• other technology platforms with respect to the enterprise services we provide, such as technology products and solutions via Galileo and Technisys;

12 unchanged sentences

• our ability to offer competitive interest rates on deposit accounts;

SoFi Technologies, Inc.

• the ease of use, performance, price and reliability of solutions developed either by us or our competitors;

5 unchanged sentences

• the impact of macroeconomic conditions, including changes in interest rates, stock market volatility, changes in consumer confidence, consumer discretionary spending, and any changes in loan default rates, and related developments on the lending and financial services markets we serve;

SoFi Technologies, Inc.

• our brand strength relative to our competitors.

Our current and future business prospects demand that we act to meet these competitive challenges but, in doing so, our revenues and results of operations could be adversely affected if we, for example, increase marketing or other expenditures or make new expenditures in other areas.

Competitive pressures could also result in us reducing the annual percentage rate on the loans we originate, increasing the annual percentage rate we pay on the checking and savings product, charging fees for services we currently provide for free, incurring higher member or technology platform client acquisition costs, or make it more difficult for us to grow our loan originations in both number of loans and volume for new as well as existing members or expand the adoption of additional products by our current, or acquire new, technology platform clients.

Competitive pressures could also result in us reducing the annual percentage rate on the loans we originate, increasing the annual percentage rate we pay on the checking and savings product, charging fees for services we currently provide for free, such as SoFi Plus, incurring higher member or technology platform client acquisition costs, or make it more difficult for us to grow our loan originations in both number of loans and volume by principal balance for new as well as existing members or expand the adoption of additional products by our current, or acquire new, technology platform clients.

All of the foregoing factors and events could adversely affect our business, financial condition, results of operations, cash flows and future prospects.

Increased market volatility and adverse changes in financial market conditions may increase our market risk.

Market volatility and adverse changes in financial market conditions may increase our market risk.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest rates, fluctuations in equity, commodity and futures prices, the implied volatility of interest rates and credit spreads and other economic and business factors.

5 unchanged sentences

Our marketing channels include, but are not limited to, earned media through press, social media and search engine optimization, as well as paid advertising, such as online affiliations, search engine marketing, digital marketing, social media marketing, influencer marketing, offline partnerships, out-of-home, direct mail, lifecycle marketing and television and radio advertising.

Our ability to compete for, attract and maintain members, lending counterparties, marketing partners and other partners relies to a large extent on their trust in our business, our reputation and the value of our brand.

Our ability to compete for, attract and maintain members, lending counterparties, Loan Platform Business counterparties, marketing partners and other partners relies to a large extent on their trust in our business, our reputation and the value of our brand.

While our goal remains to increase the strength, recognition and trust in our brand by increasing our member base and expanding our products and services, if any of our current marketing channels becomes less effective, if regulatory requirements, including the CFPB and FDIC’s advertising rules, restrict or diminish our ability to use these channels, if we are unable to continue to use any of these channels, if we receive negative publicity or fail to maintain our brand, if the cost of using these channels significantly increases or if we are not successful in generating new channels, we may not be able to attract new members or increase the activity of our existing members on our platform in a cost-effective manner.

1 unchanged sentence

Such unreasonable advantage can include distorting the shopping experience for a consumer financial product or service by giving preferential treatment to an operator or lead generator’s own or other products or services through steering or enhanced product placement, for financial or other benefits.

If we are unable to recover our marketing costs through increases in the size, value or the overall number of loans we originate, or member selection and utilization of other SoFi products such as SoFi Money, SoFi Invest and SoFi Credit Card, it could have a material adverse effect on our business, financial condition, results of operations, cash flows and future prospects.

SoFi Technologies, Inc.

could have a material adverse effect on our business, financial condition, results of operations, cash flows and future prospects.

In addition, negative publicity can adversely affect our reputation and damage our brand, and may arise from many sources, including actual or alleged misconduct, errors or improper business practices by employees, employee claims of discrimination or harassment, product failures, existing or future litigation or regulatory actions, inadequate protection of consumer information by us or our third-party service providers, data breaches, matters related to or affecting our financial reporting or compliance with SEC and Nasdaq listing requirements and media coverage, whether accurate or not.

Negative publicity or allegations could reduce demand for our products, result in a decrease in the price of our stock, undermine the loyalty of our members and the confidence of our lending counterparties and technology platform clients, impact our partnerships, reduce our ability to recruit and retain employees or lead to greater regulatory scrutiny, all of which could lead to the attrition of our members, lending counterparties, and/or technology platform clients and harm our results of operations.

Negative publicity or allegations could reduce demand for our products, result in a decrease in the price of our stock, undermine the loyalty of our members and the confidence of our lending counterparties and technology platform clients, impact our partnerships, reduce our ability to recruit and retain employees or lead to greater regulatory scrutiny, all of which could lead to the attrition of our members, lending counterparties, Loan Platform Business counterparties and/or technology platform clients and harm our results of operations.

In addition, we and our officers, directors and/or employees have been, and may in the future be, named or otherwise involved in litigation or claims, including employment-related claims such as workplace discrimination or harassment, which could result in negative publicity and/or adversely impact our business, even if we are ultimately successful in defending against or litigating such claims.

SoFi Technologies, Inc.

Reputational harm, including as a result of our actual or alleged conduct or public opinion of the financial services industry generally, could adversely affect our business, results of operations, and financial condition.

Reputation risk, or the risk to our business, earnings and capital from negative public opinion, is inherent in our business and has increased substantially because of our size and profile in the financial services industry.

Reputation risk, or the risk to our business, earnings and capital from negative public opinion, is inherent in our business and continues to increase substantially because of our size and profile in the financial services industry.

Moreover, negative public opinion has in the past and could in the future result from actions by the financial services industry generally, including due to the failure of one or more additional banks, or by certain members or individuals in the industry and can adversely affect our reputation with no actual or alleged actions on our part.

1 unchanged sentence

Negative public opinion could result from our actual or alleged conduct in any number of activities, including sales and marketing practices;

home loan or other consumer lending practices;

consumer lending practices;

loan origination or servicing activities;

10 unchanged sentences

and disclosure, sharing or inadequate protection or improper use of member or customer information, and from actions taken by government regulators and community or other organizations in response to that conduct.

Although we have policies and procedures in place intended to detect and prevent conduct by employees and third-party service providers that could potentially harm members or customers or our reputation, there is no assurance that such policies and procedures will be fully effective in preventing such conduct.

Although we have policies and procedures in place intended to detect and prevent conduct by us, our employees and third-party service providers that could potentially harm members or customers or our reputation, there is no assurance that such policies and procedures will be fully effective in preventing such conduct.

Furthermore, our actual or perceived failure to address or prevent any such conduct or otherwise to effectively manage our business or operations could result in significant reputational harm.

4 unchanged sentences

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

We communicate certain ESG-related initiatives regarding our employees, climate-related commitments and goals, and other matters in our ESG Report, on our website, in our filings with the SEC, and elsewhere.

We communicate certain ESG-related initiatives regarding our employees, climate-related commitments, governance-related metrics, including for executive compensation, and other matters in our ESG Report, on our website, in our filings with the SEC, and elsewhere.

These initiatives and commitments could be difficult to achieve and costly to implement.

We could fail to achieve, or be perceived to fail to achieve, our ESG-related initiatives or commitments.

In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them.

In addition, we could be criticized for the timing, scope or nature of these initiatives or commitments, or for any revisions to them.

To the extent that our required and voluntary disclosures about ESG matters change, we could be criticized for the accuracy, adequacy, or completeness of such disclosures.

Our actual or perceived failure with respect to our ESG-related initiatives, goals, or commitments could negatively impact our reputation, result in ESG-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

We may be unable to satisfactorily meet evolving standards, regulations and disclosure requirements related to ESG.

Our actual or perceived failure with respect to our ESG-related initiatives or commitments could negatively impact our reputation, result in ESG-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

SoFi Technologies, Inc.

We also face risk from evolving standards, regulations and disclosure requirements related to ESG, which we may fail to satisfactorily meet.

For example, a number of state legislators and regulators have adopted or are currently considering proposing or adopting other rules, regulations, directives, initiatives and laws requiring ESG-related disclosures or conduct, including California laws S.B.

The adoption of these and similar laws could require us to, among other things, expend material capital resources in connection with such compliance efforts.

The adoption of these and similar laws could require us to, among other things, expend material capital resources in connection with compliance efforts.

Furthermore, there continues to be a lack of consistent proposed climate change and ESG-related legislation and guidance, which creates regulatory and economic uncertainty.

1 unchanged sentence

Any failure, or perceived failure, to meet evolving regulations and industry standards could have an adverse effect on us.

In addition, in recent years “anti-ESG” sentiment has gained momentum across the U.S., with several states and Congress having proposed or enacted “anti-ESG” policies, legislation, or initiatives or issued related legal opinions, and President Trump having recently issued an executive order discouraging diversity equity and inclusion (“DEI”) initiatives in the private sector.

In addition, in recent years “anti-ESG” sentiment has gained momentum across the U.S., with several states and Congress having proposed or enacted “anti-ESG” policies, legislation, or initiatives or issued related legal opinions, and President Trump having issued an executive order discouraging diversity equity and inclusion (“DEI”) initiatives in the private sector.

Such anti-ESG and anti-DEI-related policies, legislation, initiatives, litigation, legal opinions, and scrutiny could result in volatility of our stock price and the Company facing additional compliance obligations, becoming the subject of investigations and enforcement actions, or sustaining reputational harm.

SoFi Technologies, Inc.

We may experience fluctuations in our quarterly operating results.

We may experience fluctuations in our quarterly operating results due to a number of factors, including changes in the fair values of our instruments (including, but not limited to, our loans), the level of our expenses, the degree to which we encounter competition in our markets, general economic conditions, significant changes in default rates on loans, the rate and credit market environment and our ability to raise our coupon rates along with interest rates that are higher than those in the recent past, legal or regulatory developments, changing demographics, and legislative, regulatory or policy changes.

We may experience fluctuations in our quarterly operating results due to a number of factors, including changes in the fair values of our instruments (including, but not limited to, our loans), the level of our expenses, the degree to which we encounter competition in our markets, general economic conditions, significant changes in default rates on loans, including credit card receivables, the rate and credit market environment and our ability to raise our coupon rates along with interest rates that are higher than those in the recent past, legal or regulatory developments, changing demographics, and legislative, regulatory or policy changes.

In light of these factors, results for any period should not be relied upon as being indicative of performance in future periods.

3 unchanged sentences

It is not possible for us to predict the future level of demand for our loans by these or other purchasers.

In addition, purchases of our loans by these purchasers have historically fluctuated and may continue to fluctuate based on a number of factors, some of which may be outside of our control, including economic conditions, the availability of alternative investments, changes in the terms of the loans, loans offered by competitors, prevailing interest rates and a change in business plan, liquidity or strategy by the purchaser.

If any of these purchasers significantly reduces the dollar amount of the loans it purchases from us, we may be unable to sell those loans to another purchaser on favorable terms or at all, which may require us to reduce originations or hold additional loans on balance sheet and may reduce our flexibility in making financing decisions.

In addition, purchases of our loans by these purchasers have historically fluctuated and may continue to fluctuate based on a number of factors, certain of which may be outside of our control, including economic conditions, the availability of alternative investments, changes in the terms of the loans, loans offered by competitors, prevailing interest rates and a change in business plan, liquidity or strategy by the purchaser.

If any of these purchasers significantly reduces the dollar amount of the loans it purchases from us, we may be unable to sell those loans to another purchaser on favorable terms or at all, which may require us to reduce originations or hold additional loans on our balance sheet and may reduce our flexibility in making financing decisions.

In addition, the loss of one or more significant purchasers of our loans could increase the volatility of the mark-to-market methodology we use to determine the fair value of the loans we hold on balance sheet.

This may have a material adverse effect on our revenues, results of operations, capital requirements, liquidity and cash flows.

We originate personal loans under the Loan Platform Business for a concentrated number of counterparties, and the loss of one or more significant Loan Platform Business counterparties could have a negative impact on our operating results.

We originate personal loans under the Loan Platform Business for a concentrated number of counterparties.

Although Loan Platform Business counterparties agree to purchase on a largely committed basis, there are inherent risks whenever a large percentage of a business is concentrated with a limited number of parties.

It is not possible for us to predict the future level of demand for our personal loans by these or other Loan Platform Business counterparties.

In addition, purchases of our personal loans by these Loan Platform Business counterparties have historically fluctuated and may continue to fluctuate based on a number of factors, certain of which may be outside of our control, including economic conditions, the availability of alternative investments, changes in the terms of the personal loans, personal loans offered by competitors, prevailing interest rates and a change in business plan, liquidity or strategy by the counterparty.

If any of these counterparties significantly reduces the dollar amount of the Loan Platform Business loans it orders from us, we may be unable to find another counterparty for the Loan Platform Business on favorable terms or at all, which may require us to reduce originations under the Loan Platform Business or hold additional loans on balance sheet and may reduce our flexibility in making financing decisions.

This may have a material adverse effect on our revenues, results of operations, capital requirements, liquidity and cash flows.

SoFi Technologies, Inc.

Galileo and Technisys depend on a small number of clients, the loss or disruptions in operations of any of which could have a material adverse effect on their businesses and financial results, and negatively impact our financial results and results of operations.

Galileo and Technisys revenue from clients is highly concentrated.

There are inherent risks whenever a large percentage of net revenue is concentrated with a limited number of clients, including fluctuations in revenue, the loss of any one or more of those clients as a result of bankruptcy or insolvency proceedings involving the client, the loss of the client to a competitor, harm to that client’s reputation or financial prospects or other reasons, including adverse general economic conditions affecting Galileo and Technisys clients many of which are fintechs and other financial services firms.

Any reduction in the amount of revenues that we derive from these clients, without an offsetting increase in new sales to other clients, has had and could have a material adverse effect on our operating results in the future.

Galileo and Technisys revenue from clients is highly concentrated and a significant Galileo client recently moved to a competitor.

There are inherent risks whenever a large percentage of net revenue is concentrated with a limited number of clients, including fluctuations in revenue, the loss of any one or more of those clients as a result of bankruptcy or insolvency proceedings involving the client, the loss of additional clients to a competitor, harm to that client’s reputation or financial prospects or other reasons, including adverse general economic conditions affecting Galileo and Technisys clients many of which are fintechs and other financial services firms.

Any further reduction in the amount of revenue that we derive from these clients, without an offsetting increase in new sales to other clients, has had and could have a material adverse effect on our operating results in the future.

A significant change in the liquidity or financial position of our clients could also have a material adverse effect on our liquidity and our future operating results.

1 unchanged sentence

We rely on third parties to perform certain key functions, and their failure to perform those functions could adversely affect our business, financial condition and results of operations.

We rely on certain third-party computer systems or third-party service providers, including cloud technology providers such as AWS, internet service providers, payment services providers, market and third-party data providers, regulatory and compliance services providers, clearing systems, market makers, exchange systems, banking technology systems, co-location facilities, communications facilities and other facilities to run our platform, facilitate trades by our members and support or carry out certain functions.

We rely on certain third-party computer systems or third-party service providers, including cloud technology providers such as AWS, internet service providers, payment services providers, including for our self-serve global remittance product, market and third-party data providers, regulatory and compliance services providers, clearing systems, market makers and other liquidity providers, exchange systems, banking technology systems, co-location facilities, communications facilities and other facilities to run our platform, facilitate trades by our members and support or carry out certain functions.

For example, to provide our checking and savings account, cash management account, credit cards and other products and services, we rely on third parties that we do not control, such as payment card networks, our acquiring and issuing processors, payment card issuers, various financial institution partners, systems like the ACH, and other partners.

2 unchanged sentences

Any interruption in these third-party services, or deterioration in the quality of their service or performance, could be disruptive to our business.

Furthermore, third parties may rely on artificial intelligence or machine learning for the services they provide us and, given that the regulatory framework relating to the use of machine learning and artificial services in the provision of financial services is still developing, the third

SoFi Technologies, Inc.

parties’ use of such technologies may impact their ability to carry out certain functions or impact the quality of their service or performance.

Because we are a bank holding company subject to regulation, supervision and examination by the Federal Reserve, and because SoFi Bank is subject to regulation, supervision and examination by the OCC and the FDIC, and SoFi Bank and its affiliates are subject to regulations issued by the CFPB, our and SoFi Bank’s oversight of third-party service providers is also subject to regulatory oversight.

In 2024, the Federal Reserve, OCC and FDIC increased their focus on regulating banks’ relationships and oversight over third-party service providers.

For example, these agencies published interagency guidance and a joint statement on banks’ vendor management practices and arrangements with third parties to deliver bank products and services in May 2024 and July 2024, respectively, and these and other regulatory authorities continued to scrutinize and take enforcement actions against banks and their business partners for insufficient third-party management programs in 2024.

In addition, because Galileo provides technology services to SoFi Bank, we are subject to additional regulatory scrutiny under Regulation W which requires, among other things, that arrangements between a bank and its affiliates are on market terms.

If a regulatory authority found our or SoFi Bank’s service provider oversight to be lacking, the regulatory authority could require that we or SoFi Bank implement corrective action, including limiting or terminating certain relationships with service providers, which could be costly and disruptive to our business.

Further, we may, from time to time, decide to modify or terminate relationships with third-party service providers and to perform certain functions and/or services internally.

For example, we historically used a third party bank to issue the SoFi Money debit cards and sponsor access to debit networks for payment transactions, funding transactions and associated settlement of funds, and sponsor and support ACH, check and wire transactions along with associated funds settlement.

However, after gaining direct access to debit networks, we directly perform certain services previously sponsored by the third party bank.

Although we have performed these services satisfactorily to date, there is no guarantee we will be able to continue to do so.

Additionally, the migration of any such functions and/or services may introduce additional risks and could cause disruption to our business.

Our third-party service providers are susceptible to operational, technological and security vulnerabilities, including security incidents and breaches and outages, which may impact our business, and our ability to monitor our third-party service providers’ data security is limited.

Furthermore, third parties may rely on AI or machine learning for the services they provide us and, given that the regulatory framework relating to the use of AI and machine learning services in the provision of financial services is still developing, the third parties’ use of such technologies may impact their ability to carry out certain functions or impact the quality of their service or performance.

Our third-party service providers are susceptible to, and have experienced, operational, technological and security vulnerabilities, including security incidents and breaches and outages, which may impact our business, and our ability to monitor our third-party service providers’ data security is limited.

In addition, these third-party service providers may rely on subcontractors to provide services to us that face similar risks.

2 unchanged sentences

However, due to the size and complexity of our technology platform and services, the amount of data that we store and the number of members, technology platform clients, employees and third-party service providers with access to personal data, we, our third-party service providers and their subcontractors are potentially vulnerable to a variety of intentional and inadvertent cybersecurity breaches and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Any contractual protections we may have from our third-party service providers may not be sufficient to adequately protect us against such consequences, and we may be unable to enforce any such contractual protections.

In addition, there is no assurance that our third-party service providers or their subcontractors will be able to continue to provide these services to meet our current needs in an efficient, cost-effective manner or that they will be able to adequately expand their services to meet our needs in the future.

Furthermore, any contractual protections we may have from our third-party service providers may not be sufficient to adequately protect us against such consequences, and we may be unable to enforce any such contractual protections.

For example, certain of our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

SoFi Technologies, Inc.

expand their services to meet our needs in the future.

Certain of our vendor agreements are terminable on short or no notice, and if current vendors were to stop providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner and on acceptable terms, or at all.

3 unchanged sentences

If a trading venue experiences a system error and/or a failure of controls, subsequent trades may be impacted, such as trading executed at anomalous pricing.

Similarly, if a trading venue experiences an outage, our customer’s ability to place trades or our ability to effect transactions in securities on behalf of

SoFi Technologies, Inc.

customers via our broker-dealer may be impacted.

Similarly, if a trading venue experiences an outage, our customer’s ability to place trades or our ability to effect transactions in securities on behalf of customers via our broker-dealer may be impacted.

As a result of these impacts, we might experience customer complaints, loss of revenue or other financial loss, or we may have to respond to regulatory inquiries related to such outages.

If a service provider fails to either provide the services required or expected or meet applicable contractual or regulatory requirements such as service levels or compliance with applicable laws, the failure could negatively impact our business.

If a service provider or their subcontractor fails to either provide the services required or expected or meet applicable contractual or regulatory requirements such as service levels or compliance with applicable laws, the failure could negatively impact our business.

Such a failure could also adversely affect the perception of the reliability of our networks and services and the quality of our brand, which could materially adversely affect our business and results of operations.

Further, if there were deficiencies in the oversight and control of our third-party relationships, and if our regulators held us responsible for those deficiencies, it could have an adverse effect on our business, reputation and results of operations.

Further, we may, from time to time, decide to modify or terminate relationships with third-party service providers and to perform certain functions and/or services internally.

However, after gaining direct access to debit networks, we directly perform certain services previously sponsored by the third party bank.

Although we have performed these services satisfactorily to date, there is no guarantee we will be able to continue to do so.

Additionally, the migration of any such functions and/or services may introduce additional risks and could cause disruption to our business.

Our oversight of third-party service providers is subject to regulation, supervision and examination by our prudential and other regulators, and if our oversight is found to be lacking, it may adversely affect our business.

In 2024, the Federal Reserve, OCC and FDIC increased their focus on regulating banks’ relationships and oversight over third-party service providers.

If a regulatory authority found our or SoFi Bank’s service provider oversight to be deficient or otherwise lacking, the regulatory authority could require that we or SoFi Bank implement corrective action, including limiting or terminating certain relationships with service providers, which could be costly and disruptive to our business and have an adverse effect on our regulatory affairs, reputation and results of operations.

A cyberattack or other security incident could result in significant costs and adversely affect our business, financial condition and results of operations.

We face risks related to cyberattacks and other security incidents, including unauthorized access to or disruption of our information systems and those of our third-party service providers and social engineering schemes that target our employees to gain access to our systems.

A successful cyberattack, data breach, or other security incident could result in significant costs and adversely affect our business, financial condition, and results of operations.

These costs include expenses for incident response, forensic investigations, system and member remediation, data recovery, and business interruption, as well as legal, regulatory, and contractual costs, including costs associated with required notifications, regulatory investigations, fines or penalties, litigation, settlements, and judgments.

In addition, a cybersecurity incident could result in increased cybersecurity and insurance costs, including higher premiums or reduced availability of coverage.

Any of the foregoing could materially and adversely

SoFi Technologies, Inc.

affect our business, financial condition, and results of operations.

Further, we may face damages resulting from a cybersecurity incident in excess of our insurance policy limits.

Beyond these direct costs, a cybersecurity incident could cause reputational harm, loss of member, prospective member, technology platform client, employee or other third-party partner confidence, reduced demand for our products or services, and diversion of management and employee resources.

Any of the foregoing could materially and adversely affect our business, financial condition, and results of operations.

See “ Information Technology and Data Risks—Cyberattacks and other security incidents and compromises could have an adverse effect on our business and systems, harm our brand and our reputation and expose us to liability.

Efforts to prevent and respond to these attacks and incidents are costly ” for additional information on the risks of cyberattacks and other security incidents to our business.

The conditional conversion feature of our convertible notes, if triggered, may adversely affect our financial condition.

18 unchanged sentences

In addition, the Capped Call Transactions are complex, and they may not operate as planned.

For example, the terms of the Capped Call Transactions may be subject to adjustment, modification or, in some cases, renegotiation if certain corporate or other transactions occur.

For example, the terms of the Capped Call Transactions may be subject to adjustment, modification or, in certain cases, renegotiation if certain corporate or other transactions occur.

Accordingly, these transactions may not operate as we intend if we are required to adjust their terms as a result of transactions in the future or upon unanticipated developments that may adversely affect the functioning of the Capped Call Transactions.

2 unchanged sentences

Our business and results of operations have in the past and may in the future be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions generally.

Our business, results of operations and reputation are directly affected by elements beyond our control, including general economic, political, social and health conditions in the U.S.

Our business and results of operations are directly affected by elements beyond our control, including general economic, political, social and health conditions in the U.S.

and in countries abroad.

4 unchanged sentences

federal debt ceiling, changes in legislation, regulations or policy, energy prices, home prices, commercial property values, bankruptcies, a default by a significant market participant or class of counterparties, market volatility, liquidity of the global financial markets, the growth of global trade and commerce, exchange rates, trade policies, the availability and cost of capital and credit, disruption of communication, transportation or energy infrastructure and investor sentiment and confidence.

Additionally, global markets have been and may in the future be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict (e.g., the escalating conflict in the Middle East and the ongoing war in Ukraine), terrorism or other geopolitical events, including the upcoming changes to the United States presidential administration, which may affect our results of operations.

For example, although we do not have operations in the locations impacted by these conflicts, the ongoing war in these locations has led and could in the future lead to macroeconomic effects, including volatility in commodity prices and the supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability, as well as an increase in cyberattacks and espionage.

Additionally, global markets have been and may in the future be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict (e.g., the confrontation in Venezuela, the ongoing conflict in the Middle East and the ongoing war in Ukraine), terrorism or other geopolitical events which may affect our results of operations.

For example, although we do not have operations in the locations impacted by these conflicts, the ongoing conflict in these locations has led and could in the future lead to macroeconomic effects, including volatility in commodity prices and the supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability, as well as an increase in cyberattacks and espionage.

Also, any sudden or prolonged market downturn in the U.S.

9 unchanged sentences

Our business is sensitive to interest rates and interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, in particular, the Federal Reserve.

The Federal Reserve increased interest rates throughout 2022 and 2023 before lowering interest rates in 2024, and we are unable to predict whether interest rates will increase or decrease in the future.

Further changes to prevailing interest rates could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes have in the past and could in the future also affect (i) our ability to originate loans at competitive rates and obtain deposits;

(ii) the fair value of our financial assets and liabilities;

(iii) the average duration of our loan portfolios and other interest-earning assets;

(iv) the mix of lending products we originate which is influenced by demand for refinancing products;

and (v) the competition faced by our SoFi Money deposit product from other investment products which may become more attractive as interest rates rise.

The Federal Reserve increased interest rates throughout 2022 and 2023 before lowering interest rates in 2024 and 2025, and we are unable to predict whether interest rates will increase or decrease in the future.

(ii) our ability to pay a competitive variable annual percentage yield for deposits;

(iii) the fair value of our financial assets and liabilities;

(iv) the average duration of our loan portfolios and other interest-earning assets;

(v) the mix of lending products we originate which is influenced by demand for refinancing products;

and (vi) the competition faced by our SoFi Money deposit product from other investment products which may become more attractive as interest rates rise.

See “ Changing expectations for inflation and fluctuations in interest rates could decrease demand for our lending products and negatively affect loan performance, as well as increase certain operating costs, such as employee compensation ” for additional information on the risks of interest rate fluctuations to our business.

SoFi Technologies, Inc.

Interest rate changes and other actions, including balance sheet management, lending facilities, and the Federal Reserve’s exit from quantitative easing, and similar actions taken by the Federal Reserve or other central banks, are beyond our control and difficult to predict.

These actions affect interest rates and the value of financial instruments, increase the likelihood of a more volatile market, a further appreciating U.S.

dollar and negative growth in gross domestic product, and affect other assets and liabilities and can impact our members and technology platform clients.

Interest rate changes and other actions, including balance sheet management, lending facilities, and various quantitative measures and similar actions taken by the Federal Reserve or other central banks, are beyond our control and difficult to predict.

These actions affect interest rates and the value of financial instruments, increase the likelihood of a more volatile market, influence the strength or weakness of the U.S.

dollar and the resulting direction of change in gross domestic product, and affect other assets and liabilities and can impact our members and technology platform clients.

Any economic downturn, especially in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations.

4 unchanged sentences

Actions taken by other countries, particularly China, to restrict the activities of businesses, could also negatively affect financial markets.

An escalation of tensions, such as a trade war between certain countries or a further escalation in conflict in the Middle East, could lead to further measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of duties and tariffs, foreign exchange measures or the large-scale sale of U.S.

An escalation of tensions, such as a trade war between certain countries or a further escalation in conflict in the Middle East or Eastern Europe or new conflict in Latin America, could lead to further measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of duties and tariffs, foreign exchange measures or the large-scale sale of U.S.

Treasury Bonds.

Any of these developments could adversely affect our business, our members, our technology platform clients, the value of our loan portfolios, our level of charge-offs and provision for credit losses, our capital levels, our liquidity and our results of operations.

Any of these developments could adversely affect our business, our members, our technology platform clients, our other counterparties, the value of our loan portfolios, our level of charge-offs and provision for credit losses, our capital levels, our liquidity and our results of operations.

We have the option of pursuing a gain-on-sale origination model and, consequently, our business is affected by the cost and availability of funding in the capital markets.

4 unchanged sentences

Our ability to obtain financing in the capital markets depends, among other things, on our development efforts, business plans, operating performance, lending activities, public perceptions of the financial services industry, and condition of, and our access to, the capital markets at the time we seek financing.

The capital markets have from time-to-time experienced periods of significant volatility, including, most recently, volatility driven by benchmark interest rate movements, uncertainty in the financial services sector, and the ongoing war in Ukraine, among other things.

The capital markets have from time-to-time experienced periods of significant volatility, including, most recently, volatility driven by benchmark interest rate movements, uncertainty in the financial services sector, the confrontation in Venezuela, the ongoing conflict in the Middle East and the ongoing war in Ukraine, among other things.

This volatility can dramatically and adversely affect financing costs when compared to historical norms or make funding unavailable.

4 unchanged sentences

consumer spending patterns, fluctuating inflation and interest rates, reduced consumer discretionary spending, and weakening wage growth, but there is no guarantee that future changes will not have an impact.

For example, the Federal Reserve increased interest rates throughout 2022 and 2023 before lowering interest rates in 2024.

We are unable to predict whether interest rates will increase or decrease in the future.

For example, the Federal Reserve increased

SoFi Technologies, Inc.

their prospects for future income growth and employment opportunities in the current economic environment, and as borrowers face uncertainty about the impact of elevated prices on their ability to repay a loan.

interest rates throughout 2022 and 2023 before lowering interest rates in 2024 and 2025.

We are unable to predict whether interest rates will increase or decrease in the future.

Continued elevated interest rates may decrease borrower demand for certain of our lending products, even as inflation places pressure on consumer spending, borrowing and saving habits as consumers evaluate their prospects for future income growth and employment opportunities in the current economic environment, and as borrowers face uncertainty about the impact of elevated prices on their ability to repay a loan.

A change in demand for our lending products and any steps we may take to mitigate such change could impact our credit quality and overall growth.

1 unchanged sentence

We have also focused on personal loan originations to offset the lower demand in other lending products.

Personal loans are a higher risk product than home loans or student loans and we have seen an increase in the amount of personal loans that we originate which may increase the inherent risk in our overall portfolio.

Personal loans are a higher risk product than home loans or student loans and we have continued to see an increase in the amount of personal loans that we originate which may increase the inherent risk in our overall portfolio.

In addition, fluctuating interest rates may increase our cost of capital and ability to offer a competitive interest rate on our loans.

1 unchanged sentence

Furthermore, economic pressure resulting in the inability of a borrower to repay a loan could translate into increased loan defaults, foreclosures and charge-offs and negatively affect our business, financial condition, results of operations, cash flows and future prospects.

Additionally, an inflationary environment combined with a healthy labor market and decreases in the market value of our equity awards could make it more costly for us to attract or retain employees.

Additionally, an inflationary environment has increased and may continue to increase the cost of labor, technology, professional services, marketing and other operating inputs, which could lead to higher wages and benefits, increased vendor and third-party service costs, and rising prices for goods and services necessary to support our operations.

For example, an inflationary environment combined with a healthy labor market and decreases in the market value of our equity awards could make it more costly for us to attract or retain employees.

In order to meet the compensation expectations of our prospective and current employees due to inflationary and other factors, we have in the past and may in the future be required to increase our operating costs or risk losing skilled workers to competitors.

See “ Personnel and Business Continuity Risks—The job market and the optimization of our workforce creates a challenge and potential risk as we strive to attract and retain a highly skilled workforce ” for more information on the risks posed by a competitive labor market.

While we may seek to mitigate these impacts through cost controls or efficiency initiatives, there can be no assurance that such measures will be successful or sufficient.

If we are unable to offset higher operating expenses with corresponding revenue growth, our margins, profitability, and cash flows could be materially and adversely affected.

Fluctuations in interest rates could negatively affect the demand for our checking and savings product.

Falling, low or fluctuating interest rates, including declining interest rates in 2024, have in the past had and may in the future have a negative impact on the demand for our checking and savings product.

Falling, low or fluctuating interest rates, including declining interest rates in 2024 and 2025, could have had in the past, and may in the future have, a negative impact on the demand for our checking and savings product.

Checking and savings provides members a digital banking experience that offers a variable annual percentage yield, which is at our discretion.

If we are not able to offer competitive interest rates on deposit accounts, demand for our checking and savings product may decrease, which may impact our ability to access deposits as a more cost-effective source of funding for our loans.

Although we have been in an elevated interest rate environment in recent years, interest rates began to decline in 2024 and there is no guarantee that the interest rate we offer on our deposit accounts will remain competitive and in a falling or low interest rate environment, account holders and prospective account holders may be discouraged from using these products, which would adversely affect our business, financial condition, results of operations, cash flows and future prospects.

Although we have been in an elevated interest rate environment in recent years, interest rates declined in 2024 and 2025 and there is no guarantee that the interest rate we offer on our deposit accounts will remain competitive and in a falling or low interest rate environment, account holders and prospective account holders may be discouraged from using these products, which would adversely affect our business, financial condition, results of operations, cash flows and future prospects.

Higher than expected payment speeds of loans could negatively impact the fair market value of the lending portfolio and our returns as the holder of the residual interests in securitization trusts holding personal and student loans.

2 unchanged sentences

Prepayment rates are subject to a variety of economic, social, competitive and other factors, including fluctuations in interest rates, availability of alternative financings, legislative, regulatory or policy changes affecting the student loan market, the home loan market, consumer lending generally and the general economy, including changing expectations for inflation.

For example, interest rates began to decline in 2024, and a lower interest rate environment may lead to higher prepayment rates on loans.

For example, interest rates continued to decline in 2025, and a lower interest rate environment may lead to higher prepayment rates on loans.

While we anticipate some variability in prepayment rates, extraordinary or extended increases or decreases in prepayment rates could materially affect our liquidity and net revenue.

For example, when, as a result of unanticipated prepayment levels, loans within a securitization trust amortize faster than originally contracted due to prepayments, the trust’s pool balance may decline at a rate faster than the prepayment rate assumed when the trust’s bonds were originally issued.

If the trust’s pool balance declines faster than originally anticipated, in most of our securitization structures, the bonds issued by that trust will also be repaid faster than originally anticipated.

If the trust’s pool balance declines faster than originally anticipated, in most of our securitization structures, the bonds issued by that

SoFi Technologies, Inc.

trust will also be repaid faster than originally anticipated.

In such cases, our net revenue may decrease, inclusive of our servicing revenue and the diminished value of any retained residual interest by us in the trust.

2 unchanged sentences

(i) affect our liquidity, (ii) impede our access to the securitization markets, (iii) require changes to our securitization structures, and (iv) raise or lower the value of the residual interests of our future securitization transactions.

SoFi Technologies, Inc.

We are exposed to financial risks that may be partially mitigated but cannot be eliminated by our hedging activities, which carry their own risks.

We continue to use, and may in the future use, financial instruments for hedging and risk management purposes in order to protect against possible fluctuations in interest rates, or for other reasons that we deem appropriate.

In particular, we expect our interest rate risk to increase with our home loans business which continues to grow, including as a result of our acquisition of Wyndham.

In particular, we expect our interest rate risk to increase with our home loans business which continues to grow.

However, any current and future hedges we enter into will not completely eliminate the risk associated with fluctuating interest rates and our hedging activities may prove to be ineffective.

13 unchanged sentences

Our success depends, in part, on our ability to expand our business.

In some circumstances, we may determine to do so through the acquisition of complementary assets, businesses and technologies rather than through internal development.

In certain circumstances, we may determine to do so through the acquisition of complementary assets, businesses and technologies rather than through internal development.

(i) in April 2020, we acquired 8 Limited, an investment business in Hong Kong, (ii) in May 2020, we acquired Galileo, a company that provides technology platform services to financial and non-financial institutions, (iii) in February 2022, we acquired Golden Pacific, a bank holding company, (iv) in March 2022, we acquired Technisys, a cloud-native digital multi-product core banking platform, and (v) in April 2023, we acquired Wyndham, a mortgage lender.

The identification of suitable acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions.

The identification of suitable

SoFi Technologies, Inc.

acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions.

The risks we face in connection with acquisitions include, among others:

• diversion of management time and focus from operating our business to addressing acquisition integration challenges;

• coordination of technology, product development, risk management and sales and marketing functions;

• diversion of management time and focus from operating our business to evaluating acquisition targets and addressing acquisition integration challenges;

• coordination of technology, product development, risk management, compliance, sales and marketing and other general administration functions;

• retention of employees from the acquired company and retention of our employees due to cultural challenges associated with integrating employees from the acquired company into our organization;

• integration of the acquired company’s accounting, management information, human resources, third-party risk management and other administrative systems;

SoFi Technologies, Inc.

• the need to implement or improve controls, procedures and policies at a business that prior to the acquisition may have lacked effective controls, information security and cybersecurity safeguards, procedures and policies, including third-party risk management practices;

2 unchanged sentences

• litigation or other claims in connection with the acquired company, including claims from terminated or current employees, customers, former stockholders or other third parties;

• known and unknown regulatory compliance risks resulting from geographic expansion, including elevated risk factors for tax compliance, money laundering controls, and supervisory controls oversight.

• known and unknown regulatory compliance risks resulting from geographic expansion, including elevated risk factors for tax compliance, money laundering and sanctions controls, and supervisory controls oversight.

Our failure to address these risks or other problems encountered in connection with our acquisitions and investments could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities and harm our business generally.

2 unchanged sentences

Demand for our products may decline if we do not continue to innovate or respond to evolving technological or other changes.

We operate in a dynamic industry characterized by rapidly evolving technology, frequent product introductions, and competition based on pricing and other differentiators.

We operate in a dynamic industry characterized by rapidly evolving technology, frequent product introductions, and competition based on product availability, pricing and other differentiators.

We continue to explore new product offerings and may rely on our proprietary technology to make our platform available to members, to service member accounts, to provide our technology platform as a service to clients and to introduce new products, which both fosters innovation and introduces new potential liabilities and risks.

In addition, we may increasingly rely on technological innovation as we introduce new types of products, expand our current products into new markets, and continue to streamline our platform.

For example, while we do not currently rely heavily on artificial intelligence, we expect to integrate more artificial intelligence into our technology in the future especially to improve the experience of our members.

Even if we enhance our current products or release new products that incorporate artificial intelligence, there can be no assurance that our products will be successful or that we will innovate effectively to keep pace with the rapid evolution of artificial intelligence.

Our ability to integrate artificial intelligence or other new technologies may also be limited by new laws or regulatory guidance.

The process of developing new technologies and products is complex, and if we are unable to successfully innovate and continue to deliver a superior member and technology platform client experience, members’ and clients’ demand for our products may decrease and our growth and operations may be harmed.

An increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure (including fines and other penalties), and could reduce the use and acceptance of SoFi Money and SoFi Credit Card.

Financial institutions like us, as well as our members, colleagues, regulators, vendors and other third parties, have experienced a significant increase in fraudulent activity in recent years and will likely continue to be the target of increasingly sophisticated fraudsters and fraud rings in the future.

This is particularly true for our newer products where we have limited experience evaluating customer behavior and performing tailored risk assessments, such as checking and savings and credit card.

For example, we have begun, and expect to continue, to integrate AI into our technology to improve the experience of our members.

In 2025, we launched and integrated an AI–driven feature that analyzes users’ SoFi and external accounts to identify suboptimal cash utilization and provides personalized, data-driven recommendations, including recommendations to reallocate funds, reduce balances, and improve overall financial health.

In addition, with the introduction of digital asset trading in the U.S.

and Hong Kong, and self-serve global remittance, we are utilizing digital assets and blockchain innovations to provide our members with new products and services.

However, even if we enhance our current products or release new products that incorporate AI and blockchain innovations, there can be no assurance that our products will be successful or that we will innovate effectively to keep pace with the rapid evolution of AI and blockchain technology.

Our ability to integrate AI, blockchain technology or other new technologies may also be limited by new laws or regulatory guidance.

See “ The launch of digital asset trading in the U.S.

and Hong Kong and use of blockchain technology in our product offerings, subjects us to laws and regulations relating to cryptocurrencies and blockchain technology in various jurisdictions where we conduct our business, and to other risks.

Such laws and regulations can be complex, are subject to change, and complying with them across various jurisdictions imposes operational, time, and cost constraints on our business.

Our actual or perceived failure to comply with such obligations or to address other risks related to these technologies could harm our business and/or result in reputational harm, loss of customers, material financial penalties and legal liabilities ” for additional information on the legal and regulatory environment surrounding digital assets.

The process of developing new technologies and products is complex, and if we are unable to

SoFi Technologies, Inc.

successfully innovate and continue to deliver a superior member and technology platform client experience, members’ and clients’ demand for our products may decrease and our growth and operations may be harmed.

Financial institutions like us, as well as our members, technology platform clients, colleagues, regulators, vendors and other third parties, have experienced a significant increase in fraudulent activity in recent years and will likely continue to be the target of increasingly sophisticated fraudsters and fraud rings in the future.

This is particularly true for our newer products where we have limited experience evaluating customer behavior and performing tailored risk assessments, such as checking and savings, credit card and digital assets.

We develop and maintain systems and processes aimed at detecting and preventing fraudulent activity, which require significant investment, maintenance and ongoing monitoring and updating as technologies and regulatory requirements change and as efforts to overcome security and anti-fraud measures become more sophisticated.

3 unchanged sentences

Risks associated with each of these include theft of funds and other monetary loss, the effects of which could be compounded if not detected quickly.

SoFi Technologies, Inc.

activity may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered.

Fraudulent activity may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered.

Fraudulent activity and other actual or perceived failures to maintain a product’s integrity and/or security has led to increased regulatory scrutiny and may lead to regulatory investigations and intervention (such as mandatory card reissuance), increased litigation (including class action litigation), remediation, fines and response costs, negative assessments of us and our subsidiaries by regulators and rating agencies, reputational and financial damage to our brand, and reduced usage of our products and services, all of which could have a material adverse impact on our business.

1 unchanged sentence

Any failure in these services provided to technology platform clients could result in regulatory actions or fines, and potential loss of client accounts.

Our SoFi Crypto offering exposes us to additional fraud risk.

Cryptocurrency transactions and related activities are subject to elevated fraud risks due to factors such as pseudonymity, rapid transaction settlement, limited ability to reverse transactions, evolving fraud techniques, and the use of decentralized or third-party platforms that may be outside our control.

Fraudulent activities may include account takeovers, social engineering schemes, scams, theft of private keys, malware attacks, and misuse of our platforms to facilitate illicit activity.

While we employ fraud detection, monitoring, and compliance controls designed to mitigate these risks, such controls may be less effective in identifying or preventing cryptocurrency-related fraud compared to traditional financial products, particularly as fraudsters continue to adapt their methods.

If fraud occurs, we may incur financial losses, increased operational and compliance costs, customer remediation expenses, regulatory scrutiny, reputational harm, and potential legal liability.

Any failure to effectively prevent, detect, or respond to cryptocurrency-related fraud could materially and adversely affect our business and results of operations.

Successful fraudulent activity and other incidents related to the actual or perceived failures to maintain the integrity of our processes and controls could negatively affect us, including harming the market perception of the effectiveness of our security measures or harming the reputation of the financial system in general, which could result in reduced use of our products and services.

Such events could also result in legislation and additional regulatory requirements.

Although we maintain insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.

Although we maintain insurance, including specifically with respect to our digital asset products, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.

We may be unable to realize the anticipated benefits of acquiring Technisys.

We closed the Technisys acquisition in March 2022 and its operations have been largely integrated into our business.

The success of the Technisys acquisition, including anticipated benefits and cost savings and potential additional revenue opportunities, will depend, in part, on our ability to realize various benefits, including, among other things, the development of an end-to-end vertically integrated banking technology stack to support multiple products and enable the combined company to meet the expanding needs of existing customers and serve additional established banks, fintechs and non-financial brands looking to enter financial services.

SoFi Technologies, Inc.

meet the expanding needs of existing customers and serve additional established banks, fintechs and non-financial brands looking to enter financial services.

The inability to realize our expected cost savings in connection with the Technisys’ acquisition could have an adverse effect on our business, financial condition, operating results and prospects.

3 unchanged sentences

Additionally, with the acquisition of Galileo in May 2020, we gained clients in Canada, Mexico and Colombia and, with the acquisition of Technisys in March 2022, we further expanded our operations into Latin America.

In 2025, we expanded our consumer banking product with the introduction of self-serve global remittance services in over thirty countries.

We may, in the future, continue to pursue further international expansion of our business operations, either organically or through acquisitions, in new international markets where we have limited or no experience in marketing, selling and deploying our products and services.

7 unchanged sentences

• burdens of enforcing and complying with a variety of foreign laws;

• reduced protection for intellectual property rights in some countries;

• reduced protection for intellectual property rights in certain countries;

• difficulties in staffing and managing global operations and the increased travel, infrastructure and legal compliance costs associated with multiple international locations and subsidiaries;

• different regulations and practices with respect to employee/employer relationships, existence of workers’ councils and labor unions, and other challenges caused by distance, language, and cultural differences, making it harder to do business in certain international jurisdictions;

SoFi Technologies, Inc.

• compliance with statutory equity requirements;

1 unchanged sentence

If we are unable to manage the complexity of global operations successfully, our financial performance and operating results could suffer.

The launch of digital asset trading in the U.S.

Such laws and regulations can be complex, are subject to change, and complying with them across various jurisdictions imposes operational, time, and cost constraints on our business.

In 2025, we launched SoFi Crypto in the U.S.

and digital asset trading in Hong Kong, allowing our members to buy, sell and hold digital assets, which, along with any additional cryptocurrency products and other products that utilize blockchain technology that we may offer in the future, subjects us to additional regulations, licensing requirements, and other obligations.

Compliance with any such regulations, requirements, or obligations may be complex and costly.

Cryptocurrencies are not considered legal tender, are not backed by most governments, and have experienced technological flaws and various law enforcement and regulatory interventions.

In addition, in the U.S.

and certain other jurisdictions, certain cryptocurrencies may be deemed to be securities and subject to the securities laws of the relevant jurisdictions.

Furthermore, our crypto offering in Hong Kong is subject to evolving regulatory requirements under Hong Kong’s licensing and virtual asset regime.

Although Hong Kong has established a licensing framework for virtual asset trading platforms and related services, these rules are complex, subject to change, and may impose additional compliance obligations on firms engaging in crypto activities.

The rapidly evolving regulatory landscape with respect to cryptocurrencies may subject us to registrations, inquiries, or

SoFi Technologies, Inc.

investigations from regulators and governmental authorities;

require us to make product changes;

restrict or discontinue product offerings;

and implement additional and potentially costly controls.

If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions and potential fines or reputational harm, be forced to cease offering cryptocurrency products, and other consequences, including significant financial losses.

Cryptocurrencies have in the past and may in the future experience periods of extreme price volatility.

These uncertainties, as well as future accounting and tax developments, or other requirements relating to cryptocurrencies could expose us to litigation, regulatory action and possible liability, and have an adverse effect on our business.

As we enter into and expand our cryptocurrency product and service offerings, the risks associated with failing to safeguard and manage cryptocurrencies held by us or our custodians, or that our service providers transfer on behalf of our customers, may increase.

In addition, a number of errors could occur in the process of depositing or withdrawing cryptocurrencies such as typos, mistakes or failure to include information required by the blockchain network, or any other internal failures or deficiencies in our own systems or those of any custodian or other third party provider we may use, could, in each case, materially and adversely affect our members and our operations.

In addition, cryptocurrencies and blockchain technologies have been, and might in the future be, subject to security breaches, hacking or other malicious activities.

Failures in internal controls or key management practices, whether by us or a service provider, could lead to irreversible asset loss or unauthorized transfers.

Defaults by counterparties or systemic stress in crypto-asset markets may also pose significant liquidity, settlement, or valuation risks.

Any such failure or event could result in reputational harm, significant financial losses, lead customers to discontinue or reduce their use of our services, and result in significant penalties and fines and additional restrictions.

In addition, we may rely on third parties for certain aspects of cryptocurrency offerings and reliance on third parties involves risks.

For example, inappropriate access to, theft, destruction or other loss of cryptocurrency assets held by any counterparty we may use, insufficient insurance coverage by us or any such counterparty to reimburse us for all such losses, such counterparty’s failure to maintain effective controls over the custody, asset and settlement services provided to us, such counterparty’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by counterparty financial institutions, could materially and adversely affect our financial performance and significantly harm our business.

In addition, we plan to integrate blockchain technology from a third party provider into certain of our products.

Any number of technical changes, software upgrades, cybersecurity incidents or other changes to the underlying blockchain networks might occur from time to time, causing incompatibility, technical issues, disruptions or security weaknesses to our products.

If we or our third party provider are unable to identify, troubleshoot and resolve any such issues successfully, we might no longer be able to support such products, our customers’ assets might be frozen or lost, the security of our products might be compromised and our platforms and technical infrastructure might be affected, all of which could cause revenue to decline and expose us to potential liability for customer losses.

We are new to global remittance services and engaging in such services exposes us to numerous risks, including compliance with complex laws and regulations across jurisdictions, and operational risks, each of which could materially and adversely affect our business, results of operations, and financial condition.

We recently launched global remittance services between the United States and thirty countries, including Mexico, India, Brazil and the European Union, and we expect to expand these and similar services to and between other international locations.

The success of this product depends in part on our ability to provide global remittance services compliantly, efficiently and securely.

Global remittance services involve complex regulatory, legal, and compliance requirements, including licensing, anti-money laundering, counter-terrorism financing, economic sanctions, data privacy and cybersecurity, customer disclosure, foreign exchange control laws, and monitoring, examination, and oversight by regulatory agencies across multiple jurisdictions.

These frameworks differ significantly between countries and are subject to change, interpretation, and enforcement by various authorities.

Failure to maintain compliance, or even the perception of noncompliance, may result in investigations, penalties, restrictions on our operations, or the loss of licenses and banking relationships necessary to provide global remittance services.

Our compliance and regulatory risk related to global remittance services is expected to increase as we expand our operations into additional jurisdictions because the provision of global remittance services is highly regulated, and the requirements vary from jurisdiction to jurisdiction.

We are currently working with third-party partners who are licensed to provide global remittance services in the jurisdictions in which we operate and plan to operate.

We may, as our global remittance services expand, obtain licenses directly in various jurisdictions.

If we become licensed to provide these services by various governmental authorities, we would become subject to extensive financial, operational, and other regulatory

SoFi Technologies, Inc.

requirements to maintain our licenses and conduct business.

If our licenses are not renewed or we are denied licenses in additional jurisdictions where we choose to apply for a license, we could be forced to change our business practices or to comply with the requirements of the additional jurisdictions, each of which could require us to bear substantial cost.

Further, if we were found by these governmental authorities to be in violation of any applicable laws or regulations required to provide global remittance services, we could be subject to fines, penalties, lawsuits, and enforcement actions;

additional compliance requirements;

increased regulatory scrutiny of our business;

restriction or suspension of our operations;

or damage to our reputation or brand.

Regulatory requirements are constantly evolving, and we cannot predict whether we will be able to meet changes to existing regulations or the introduction of new regulations without harming our business, financial condition, operating results, and future prospects.

Additionally, global remittance services are subject to higher operational risks, including delays, transaction errors, and fraudulent activities, particularly in regions with less developed financial infrastructure, including settlement timing differences, and exposure to local liquidity constraints which may impact the predictability and profitability of our global remittance services.

Political instability, trade restrictions, current or new tax laws, or economic sanctions imposed on certain countries may further restrict our ability to provide global remittance services in specific markets.

Furthermore, we currently rely on third-party partners to facilitate global remittance services and may rely on additional third-parties in the future.

In addition, our third-party partners may rely on local partners for delivery of their services.

Any disruption, error, or compliance failure by these partners could lead to financial loss, reputational damage, and customer dissatisfaction, including related to the experience of our members’ recipients.

If the experience delivered to a recipient is deemed unsatisfactory for any reason, including if a third-party partner’s processes take longer than expected, members may choose to not use our services in the future and our business could be harmed.

Additionally, third-party partners charge fees, which may increase from time to time, and which could increase our costs.

Banks currently determine the fees charged for bank-originated transactions and may increase the fees with little prior notice.

federal, state, local or foreign governments could also mandate a tax on global remittance services, or require additional taxes or fees to be imposed upon our customers, or otherwise impact the manner in which we provide global remittance services.

If fees increase, it may require us to change our product options, or take other measures that would impact our costs and profitability or cause us to lose members or otherwise limit our operations.

If we are unable to effectively manage these risks or adapt our operations to evolving international regulatory environments, our ability to further expand our global remittance services and similar services, and maintain compliance could be impaired, and our business, financial condition, and results of operations could be materially and adversely affected.

Credit Market Related Risks

1 unchanged sentence

In an economic downturn, member default rates may increase, there may be decreased demand for our products, and there may be adverse impacts to our business.

Recent macroeconomic factors, such as elevated interest rates, global events and market volatility and general uncertainty, may cause the economy to enter into a period of slower economic growth or a recession, the length and severity of which cannot be predicted.

Recent macroeconomic factors, such as fluctuating interest rates, inflation, global events and market volatility and general uncertainty, may cause the economy to enter into a period of slower economic growth or a recession, the length and severity of which cannot be predicted.

Such uncertainty and negative trends in general economic conditions can have a significant negative impact on our ability to generate adequate revenue and to absorb expected and unexpected losses.

Many factors, including factors that are beyond our control, may result in higher default rates by our members and non-payment by our technology platform clients, a decline in the demand for our products, and potentially impact our ability to make accurate credit assessments, lending decisions or technology platform client selections.

Many factors, including factors that are beyond our control, may result in higher default rates by our members and non-payment by our technology platform clients, a decline in the demand for our products, including a reduction in deposits, and potentially impact our ability to make accurate credit assessments, lending decisions or technology platform client selections.

Any of these factors could have a detrimental impact on our financial performance and liquidity.

2 unchanged sentences

Declining economic conditions may also lead to either decreased demand for our loans or demand for a higher yield on our loans, and consequently lower prices or a lower advance rate, from institutional whole loan purchasers, securitization investors and warehouse lenders on whom we rely for liquidity.

The longevity and severity of a downturn or recession would also place pressure on lenders under our debt warehouses, whole loan purchasers and investors in our securitizations, each of whom may have less available liquidity to invest in our loans, and long-term market disruptions could negatively impact the securitization market as a whole.

Although certain of our debt warehouses contain committed terms, there can be no assurance that our financing arrangements will remain available to us through any particular business cycle or be renewed on the same terms.

Declining economic conditions and any resulting increase in charge-offs may also reduce demand for our personal loans by Loan Platform Business counterparties.

The longevity and severity of a downturn or recession would also place pressure on lenders under our debt warehouses, whole loan purchasers, Loan Platform Business counterparties and investors in our securitizations, each of whom may have less available liquidity to invest in our loans, and long-term market disruptions could negatively impact the

SoFi Technologies, Inc.

securitization market as a whole.

Although certain of our debt warehouses contain committed terms, there can be no assurance that our financing arrangements or Loan Platform Business loan origination and sale arrangements will remain available to us through any particular business cycle or be renewed on the same terms.

The timing and extent of a downturn may also require us to change, postpone or cancel our strategic initiatives or growth plans to pursue shorter-term sustainability.

The longer and more severe an economic downturn, the greater the potential adverse impact on us.

An economic downturn or recession could also adversely affect our Financial Services products, including our deposit base and funding profile and assets held through SoFi Invest or SoFi Crypto.

During periods of economic stress, members may experience job losses, reduced income, or increased uncertainty, which could lead them to draw down savings to meet living expenses or shift funds toward perceived safer or more liquid alternatives.

These behaviors may result in deposit outflows, lower average balances in checking and savings accounts or lower average investments made through SoFi Invest or SoFi Crypto investments.

In addition, heightened market volatility or concerns about the financial sector could increase member sensitivity to interest rates, safety perceptions, and liquidity needs, intensifying competition for deposits and increasing our funding costs.

A sustained decline in deposits or an unfavorable shift in deposit composition could reduce our access to low-cost, stable funding and increase our reliance on alternative or wholesale funding sources, which may be more expensive or less available during a recession.

Such conditions could adversely affect our net interest margin, liquidity position, and ability to grow or maintain our balance sheet.

If these pressures are prolonged or severe, they could also constrain our ability to support member demand, comply with regulatory liquidity requirements, or pursue strategic initiatives, and could have a material adverse effect on our business, financial condition, and results of operations.

Our Technology Platform segment is also susceptible to worsening economic conditions that place financial stress on our current clients using our platform as a service products and services and potential new clients interested in such services.

1 unchanged sentence

Any such actions with respect to our technology platform products and services could have an adverse impact on our business.

There can be no assurance that economic conditions will be favorable for our business, that interest in purchasing our loans by financial institutions or investment by clients in our platform as a service products and services will remain at current levels, or that default rates by our members or instances of non-payment by our technology platform clients will not increase.

Reduced demand, lower prices or a lower advance rate for our loan products from institutional whole loan purchasers, securitization investors and warehouse lenders, increased default rates by our members, and reduced demand, lower prices and increased non-payment by our technology platform clients, may limit our access to capital, including debt warehouse facilities, securitizations and secured and unsecured borrowing facilities, and negatively impact our profitability.

These impacts, in addition to limiting our access to capital and negatively impacting our profitability, could also in turn increase the volatility of the mark-to-market methodology we use to determine the fair value of the loans and credit card receivables we hold on balance sheet and consequently have a material adverse effect on our revenues, results of operations, capital requirements, liquidity and cash flows.

SoFi Technologies, Inc.

There can be no assurance that economic conditions will be favorable for our business, that interest in purchasing our loans by financial institutions, the ability of members to invest in our products or investment by clients in our platform as a service products and services will remain at current levels, or that default rates by our members or instances of non-payment by our technology platform clients will not increase or that demand for our products will not decrease.

Reduced demand, lower prices or a lower advance rate for our loan products from institutional whole loan purchasers, Loan Platform Business counterparties, securitization investors and warehouse lenders, increased default rates by our members, and reduced demand, lower prices and increased non-payment by our technology platform clients, may limit our access to capital, including debt warehouse facilities, Loan Platform Business loan origination and sale arrangements, securitizations and secured and unsecured borrowing facilities, and negatively impact our profitability.

These impacts, in addition to limiting our access to capital and negatively impacting our profitability, could also in turn increase the volatility of the mark-to-market methodology and indicators of credit risk that we use to determine the fair value of certain loans and expected credit losses on credit card receivables that we hold on balance sheet, and consequently have a material adverse effect on our revenues, results of operations, capital requirements, liquidity and cash flows.

If we do not make accurate credit and pricing decisions or effectively forecast our loss rates, our business and financial results will be harmed, and the harm could be material.

1 unchanged sentence

If the decision components, rapidly deteriorating macroeconomic conditions or analytics are either unstable, biased, or missing key pieces of information, the wrong decisions will be made, which will negatively affect our financial results.

If our credit decisioning strategy fails to adequately predict the creditworthiness of our members, including a failure to predict a member’s true credit risk profile and ability to repay their loan or credit card balance, higher than expected loss rates will impact the fair value of our loans and credit card receivables.

Additionally, if any portion of the information pertaining to the prospective member is false, inaccurate or incomplete, and our systems did not detect such falsities, inaccuracies or incompleteness, or any or all of the other components of our credit decision process fails, we may experience higher than forecasted losses, including losses attributed to fraud.

1 unchanged sentence

If one of these third parties experiences an outage, if we are unable to access the third-party data used in our decision strategy, if such data contains inaccuracies or our access to such data is limited, our ability to accurately evaluate potential members will be compromised, and we may be unable to effectively predict credit losses inherent in our loan portfolio, which would negatively impact our results of operations, which could be material.

Additionally, if we make errors in the development, validation, or implementation of any of the underwriting models or tools that we use for the loans securing our debt warehouses or included in securitization transactions or whole loan sales, such loans may experience higher delinquencies and losses, which would negatively impact our debt warehouse financing terms and future securitization and whole loan sale transactions.

SoFi Technologies, Inc.

Additionally, if we make errors in the development, validation, or implementation of any of the underwriting models or tools that we use for the loans securing our debt warehouses or included in securitization transactions or whole loan sales, or originated and sold to Loan Platform Business counterparties, such loans may experience higher delinquencies and losses, which would negatively impact our debt warehouse financing terms and future securitization, whole loan sale transactions and Loan Platform Business loan origination and sale arrangements.

If the information provided to us by applicants is incorrect or fraudulent, we may misjudge an applicant’s qualification to receive a loan or use one of our products, and our results of operations may be harmed.

3 unchanged sentences

Inaccurate analysis of credit data that could result from false loan application information could harm our reputation, business and results of operations.

Additionally, we rely on the accuracy of applicant information in approving applicants for our non-lending products, such as SoFi Money, SoFi Credit Card or SoFi Invest accounts.

Additionally, we rely on the accuracy of applicant information in approving applicants for our non-lending products, such as SoFi Money, SoFi Credit Card, SoFi Invest or SoFi Crypto accounts.

If the information provided to us by these applicants is incorrect or fraudulent and we are unable to detect the inaccuracies, it increases our regulatory and fraud risk and the risk of identity theft to our members, and could harm our reputation, business and results of operations.

9 unchanged sentences

These processes may entail greater risks than paper-based loan origination processes, including regarding the sufficiency of notice for compliance with consumer protection laws, risks that borrowers may challenge the authenticity of loan documents, or the validity of the borrower’s electronic signature on loan documents, and risks that unauthorized changes are made to the electronic loan documents.

If any of those factors were to cause our loans, or any of the

SoFi Technologies, Inc.

terms of our loans, to be unenforceable against the relevant borrowers, or impair our ability to service our loans (as master servicer or servicer), the value of our loan assets would decrease significantly to us and to our whole loan purchasers, securitization investors and warehouse lenders.

In addition to increased default rates and losses on our loans, this could lead to the loss of whole loan purchasers and securitization investors and trigger terminations and amortizations under our debt warehouse facilities, each of which would materially adversely impact our business.

If any of those factors were to cause our loans, or any of the terms of our loans, to be unenforceable against the relevant borrowers, or impair our ability to service our loans (as master servicer or servicer), the value of our loan assets would decrease significantly to us and to our whole loan purchasers, Loan Platform Business counterparties, securitization investors and warehouse lenders.

In addition to increased default rates and losses on our loans, this could lead to the loss of whole loan purchasers, Loan Platform Business counterparties, and securitization investors and trigger terminations and amortizations under our debt warehouse facilities, each of which would materially adversely impact our business.

Student loans are subject to discharge in certain circumstances.

Private education loans, including the refinanced student loans and other student loans made by us, are generally not dischargeable by a borrower in bankruptcy.

However, a private education loan may be discharged if a debtor files an adversary claim and the bankruptcy court determines that not discharging the debt would impose an undue hardship on the debtor and the debtor’s dependents.

In addition, changes in law, regulations or governmental policies could increase the number of student loans subject to discharge in certain circumstances which would adversely affect our business.

For example, the Biden Administration gave judges more leeway to discharge student loans, resulting in more borrowers discharging their student loans in bankruptcy in 2023, compared to prior years.

It is possible that a higher percentage of borrowers will obtain relief under bankruptcy or other debtor relief laws in the future than is reflected in our historical experience.

A private education loan that is not a refinanced parent-student loan is also generally dischargeable as a result of the death or disability of the borrower.

The discharge of a significant amount of our loans could adversely affect our business and results of operations.

See “ Regulatory, Tax and Other Legal Risks — Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on our student loan portfolios and our student loan origination volume ”.

SoFi private education loans may be discharged in bankruptcy in certain situations, such as if a bankruptcy court determines that the loan is either not a qualified education loan (as defined in 225(d)(4)) of the Internal Revenue Code) or determines that not discharging the debt would impose an undue hardship on the debtor and the debtor’s dependents.

Changes in law, how courts apply the law, regulations or governmental policies could increase the number of student loans subject to discharge in certain circumstances which could adversely affect our business.

A private education loan may also be generally dischargeable as a result of the death or disability of the borrower.

SoFi Technologies, Inc.

If a higher percentage of borrowers obtain relief under bankruptcy or other debtor relief laws in the future than is reflected in our historical experience, we could experience increased loan discharges, reduced recoveries, higher charge-offs, and increased litigation and compliance costs.

In addition, adverse judicial developments could result in class action litigation, injunctions, or regulatory scrutiny relating to our servicing or collection practices with respect to such loans.

Any such developments could negatively impact the value of our student loan portfolio, the performance of related securitizations, and our financial condition and results of operations.

See “ Regulatory, Tax and Other Legal Risks — Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on borrower behavior, our student loan portfolios and our student loan origination volume ”.

Home equity loans expose us to heightened credit, property value and interest rate risk.

Home equity loans are subject to subordinate liens on the related property.

Subordinate lien loans are structurally riskier than first lien loans because, in the event of borrower default or foreclosure, holders of first lien mortgages are entitled to repayment before subordinate lien holders.

As a result, recoveries on subordinate lien loans are more sensitive to declines in residential property values and may be limited or eliminated if property values decrease or if combined loan-to-value ratios increase, In addition, changes in interest rates may adversely affect the performance and value of these loans.

Rising interest rates may increase borrower payment obligations for variable-rate loans and could contribute to higher delinquency or default rates.

Conversely, declining interest rates may increase prepayment activity, which could reduce expected yields.

Interest rate fluctuations may also negatively impact the fair value of home equity loans held on our balance sheet.

If residential property values decline, interest rates increase, or broader economic conditions weaken, we may experience higher credit losses, increased delinquencies, reduced recoveries, and impairment charges on our home equity loan portfolio, which could adversely affect our financial condition and results of operations.

In addition, our ability to sell home equity loans may be limited because these loans are not categorized as conventional for GSE purchasers.

We offer personal loans, which have a limited performance history, and therefore we have only limited prepayment, loss and delinquency data with respect to such loans on which to base projections.

10 unchanged sentences

We service all of the personal loans we originate as well as certain loans originated by third parties and, in all material respects, all of the credit cards we issue, and we have limited experience with such servicing.

We may begin servicing the student loans that we originate at some time in the future.

We rely on sub-servicers to service all of our student loans and our home loans that we deliver to GSEs and do not sell servicing-released, and to perform certain back-up servicing functions with respect to our personal loans.

We may begin servicing the student loans that we originate in the future.

We rely on sub-servicers to service all of our student loans, our home loans that we deliver to GSEs and do not sell servicing-released and certain home equity loans, and to perform certain back-up servicing functions with respect to our personal loans.

In addition, we rely on third-party service providers to perform various functions relating to our loan origination and servicing business, including fraud detection, marketing, operational functions, cloud infrastructure services, information technology, telecommunications and processing remotely created checks.

While we oversee these service providers to ensure they service our loans in accordance with our agreements and regulatory requirements, we do not have control over the operations of any of the third-party service providers that we utilize.

In the event that a third-party service provider for any reason fails to perform such functions, including through negligence, willful misconduct or fraud, our ability to process payments and perform other operational functions for which we currently rely on such third-party service providers will suffer and our business, cash flows and future prospects may be negatively impacted.

Such third-party service provider failures could also result in, among other things, increased regulatory scrutiny of our third-party service provider oversight, costly

In the event that a third-party service provider for any reason fails to perform such functions, including through negligence, willful misconduct or fraud, our

SoFi Technologies, Inc.

investigations, required corrective action and remediation, regulatory enforcement actions, class action lawsuits, and harm to our reputation.

Any failure on our part or on the part of third parties on whom we rely to perform functions related to our servicing activities to properly service our loans or the loans originated by third parties could result in us being removed as the servicer on the loans, including loans financed by our warehouse facilities or sold into our whole loan sales channel and securitization transactions.

ability to process payments and perform other operational functions for which we currently rely on such third-party service providers will suffer and our business, cash flows and future prospects may be negatively impacted.

Such third-party service provider failures could also result in, among other things, increased regulatory scrutiny of our third-party service provider oversight, costly investigations, required corrective action and remediation, regulatory enforcement actions, class action lawsuits, and harm to our reputation.

If we fail to monitor our student loan sub-servicer and ensure that such sub-servicer complies with its obligations under state laws that require student loan servicers to be licensed, we may face civil claims for damages under such state laws.

16 unchanged sentences

Conversely, an improvement in economic conditions in one or more of the geographic areas in which we have members could result in higher prepayments of their payment obligations under their loans in such states.

As a result, we and the whole loan purchasers who hold our loans or securitization investors or warehouse lenders who hold securities backed by our loans may receive principal payments earlier than anticipated, and fewer interest payments than anticipated, and face certain reinvestment risks, such as the inability to acquire loans on equally attractive terms as the prepaid loans.

In addition, higher prepayments than anticipated may have a negative impact on our servicing revenue which could cause our operating results and financial condition to be materially and adversely affected.

As a result, we and the whole loan purchasers and Loan Platform Business counterparties who hold our loans or securitization investors or warehouse lenders who hold securities backed by our loans may receive principal payments earlier than anticipated, and fewer

SoFi Technologies, Inc.

interest payments than anticipated, and face certain reinvestment risks, such as the inability to acquire loans on equally attractive terms as the prepaid loans.

Further, the concentration of our loans in one or more geographic locations may have a disproportionate effect on us or investors in our loans or securities backed by our loans if governmental authorities in any of those areas take action against us as originator, master servicer or servicer of those loans or take action affecting our ability as master servicer or servicer to service those loans.

1 unchanged sentence

If we are unable to successfully manage our assets and liabilities on the balance sheet and our funding costs, including with respect to deposit-based funding, our ability to finance additional loans and introduce new products may be negatively impacted.

We fund our operations and capital expenditures primarily through SoFi Bank deposits, warehouse funding, common equity capital, convertible debt, a corporate revolving credit facility, securitizations, and other financings.

Through SoFi Bank, we utilize deposits which generally has a lower borrowing cost of funds than warehouse financing, and we have the ability to access other funding sources, such as the FHLB and certain brokered deposit channels established by SoFi Bank.

2 unchanged sentences

In addition, there can be no assurance that we will be able to successfully access the securitization markets at any given time, and in the event of a sudden or unexpected shortage of funds in the banking and financial system, we cannot be sure that we will be able to maintain necessary levels of funding without incurring high funding costs, a reduction in the term of funding instruments, an increase in the amount of equity we are required to hold or the liquidation of certain assets.

Furthermore, there is a risk that there will be no market at all for our loans either from whole loan buyers or through investments in securities backed by our loans.

Furthermore, there is a risk that there will be no market at all for our loans either from whole loan buyers, the Loan Platform Business or through investments in securities backed by our loans.

We may require capital in excess of amounts we currently anticipate, and depending on market conditions and other factors, we may not be able to maintain our capital or obtain additional capital for our current operations or anticipated future growth on reasonable terms or at all.

As the volume of loans that we originate, and the increased suite of products that we make available to members, increases, we may be required to expand the size of our debt warehousing facilities or seek additional sources of capital.

The availability of these financing sources depends on many factors, some of which are outside of our control.

We may also experience the occurrence of events of default or breaches of financial performance or other covenants under our debt agreements, which could reduce or terminate our access to institutional funding.

The availability of these financing sources depends on many factors, certain of which are outside of our control.

We may also experience the occurrence of events of default or breaches of financial performance or other covenants under our whole loan sale, Loan Platform Business or debt agreements, which could reduce or terminate our access to those buyers and to institutional funding.

As we think about managing our assets and liabilities on the balance sheet and our funding costs, our deposit growth may slow.

9 unchanged sentences

There can be no assurance that, in the future, we will be able to obtain additional warehouse funding capacity on favorable terms, on a timely basis, or at all.

SoFi Technologies, Inc.

If we fail to meet or satisfy any of the financial or other covenants included in our warehouse facilities, we would be in default under one or more of these facilities and our lenders could elect to declare all amounts outstanding under the facilities to be immediately due and payable, enforce their interests against loans pledged under such facilities and restrict our ability to make additional borrowings.

1 unchanged sentence

These restrictions may interfere with our ability to obtain financing or to engage in other business activities, which could materially and adversely affect us.

SoFi Technologies, Inc.

There can be no assurance that we will maintain compliance with all financial and other covenants included in our warehouse facilities in the future.

3 unchanged sentences

If we are unable to find replacement financing on favorable terms, or at all, our operations could be impacted materially.

Increases in member default rates on loans could make us and our loans less attractive to whole loan buyers, lenders under debt warehouse facilities and investors in securitizations, which may adversely affect our access to financing and our business.

Increases in member default rates, due to deteriorating economic conditions or other factors, could make us and our loans less attractive to our existing or prospective funding sources, including whole loan buyers, securitization investors and lenders under debt warehousing facilities.

Increases in member default rates on loans could make us and our loans less attractive to whole loan buyers, Loan Platform Business counterparties, lenders under debt warehouse facilities and investors in securitizations, which may adversely affect our access to financing and our business.

Increases in member default rates, due to deteriorating economic conditions or other factors, could make us and our loans less attractive to our existing or prospective funding sources, including whole loan buyers, Loan Platform Business counterparties, securitization investors and lenders under debt warehousing facilities.

If our existing funding sources do not achieve their desired financial returns or if they suffer losses, they or prospective funding sources may increase the cost of providing future financing or refuse to provide future financing or purchase loans on terms acceptable to us or at all.

Our securitizations are nonrecourse to the Company and are collateralized by the pool of our loans pledged to the relevant securitization issuer.

If the loans securing our securitizations fail to perform as expected, rating agencies may place our bonds on watch or change their ratings on (or their ratings methodology for) the bonds issued by our securitization trusts.

Our loans performance and any actions taken by the rating agencies could result in the lenders under our warehouse facilities, the whole loan purchasers who purchase our loans, the investors in our securitizations who purchase securities backed by our loans, or future lenders, whole loan purchasers or securitization investors in similar arrangements, increasing the cost of providing future financing or refusing to provide future financing or purchase loans on terms acceptable to us or at all.

While this risk may be partially mitigated by our ability to hold loans on our balance sheet, in sufficient volume, high member default rates would negatively impact our financial condition.

If the loans securing our securitizations fail to perform as expected, rating agencies have in the past and may in the future place our bonds on watch or change their ratings on (or their ratings methodology for) the bonds issued by our securitization trusts.

Our loans performance and any actions taken by the rating agencies could result in the lenders under our warehouse facilities, the whole loan purchasers who purchase our loans, the investors in our securitizations who purchase securities backed by our loans, or future lenders, whole loan purchasers, Loan Platform Business counterparties or securitization investors in similar arrangements, increasing the cost of providing future financing or refusing to provide future financing or purchase loans on terms acceptable to us or at all.

While this risk may be partially mitigated by our ability to hold loans on our balance sheet and to quickly modify the origination volume under the Loan Platform Business, in sufficient volume, high member default rates would negatively impact our financial condition.

Consequently, if we were to be unable to arrange new or alternative methods of financing on favorable terms, we may have to curtail or cease our origination of loans, which could have a material adverse effect on our business, financial condition, operating results and cash flows.

We make representations and warranties in connection with the transfer of loans to whole loan purchasers, government-sponsored enterprises, and our debt warehouse lenders and securitization trusts.

We make representations and warranties in connection with the transfer of loans to whole loan purchasers, Loan Platform Business counterparties, government-sponsored enterprises, and our debt warehouse lenders and securitization trusts.

If such representations and warranties are not correct, we could be required to repurchase loans or indemnify the purchaser, which could have an adverse effect on our ability to operate and fund our business.

6 unchanged sentences

With regard to home loans insured by the Federal Housing Administration or the VA, and to the extent that any of our home loans do not comply with Federal Housing Administration or VA guidelines, we could also face claims under the False Claims Act.

In connection with our whole loan sales, we also typically covenant to repurchase any loan that enters delinquent status within the first thirty to sixty days following origination of the loan.

In connection with our whole loan sales and certain Loan Platform Business sales, we also typically covenant to repurchase any

SoFi Technologies, Inc.

loan that enters delinquent status within the first thirty to sixty days following origination of the loan.

Any significant increase in our obligation to repurchase loans or indemnify purchasers of loans could have a significant adverse impact on our cash flows, even if they are reimbursable, and could also have a detrimental effect on our business and financial condition.

2 unchanged sentences

Any such event could have an adverse impact on our business, operating results, financial condition and prospects.

In addition, in the acquisition of Wyndham, we also acquired

SoFi Technologies, Inc.

Wyndham's liability to its loan investors and loan insurers for mortgage loans originated by Wyndham, including repurchase obligations that might not be contingent upon the investor proving an error by Wyndham.

In addition, in the acquisition of Wyndham, we also acquired Wyndham's liability to its loan investors and loan insurers for mortgage loans originated by Wyndham, including repurchase obligations that might not be contingent upon the investor proving an error by Wyndham.

In addition to loan level representations and warranties, our agreements with the lenders and investors on our securitizations, debt warehouse facilities and corporate revolving debt contain a number of corporate financial covenants and early payment triggers and performance covenants.

10 unchanged sentences

If adequate capital is not available to us or is unavailable on favorable terms, including due to the cost and availability of funding in the capital markets, our business, operating results and financial condition may be harmed.

Since our founding, we have raised substantial equity and debt financing to support the growth of our business.

Since our founding and as recently as 2025, we have raised substantial equity and debt financing to support the growth of our business.

We may require additional capital to pursue our business objectives and growth strategy and respond to business opportunities, challenges or unforeseen circumstances, including supporting our lending operations, increasing our marketing expenditures to attract new members and technology platform clients and improve our brand awareness, developing our products, introducing new services, further expanding internationally in existing or new countries or further improving existing offerings and services, enhancing our operating infrastructure and potentially acquiring complementary businesses and technologies, and complying with the increased regulatory requirements for bank holding companies and banks.

2 unchanged sentences

Volatility in the credit markets in general or in the market for personal, student and home loans and credit cards in particular may also have an adverse effect on our ability to obtain debt financing.

Although our borrowing costs have trended lower following the acquisition of a national bank charter, the cost of our borrowing could increase due to market volatility, interest rates that are higher than those in the recent past, changes in the risk premiums required by lenders or the unavailability of traditional sources of debt capital.

Although our borrowing costs have trended lower following the acquisition of a national bank charter, the cost of our borrowing could increase due to market volatility, interest rates that, while decreasing, remain higher than those in the recent past, changes in the risk premiums required by lenders or the unavailability of traditional sources of debt capital.

Volatility or depressed valuations or trading prices in the equity markets may similarly adversely affect our ability to obtain equity financing.

Furthermore, if we raise additional funds through further issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

Furthermore, if we raise additional funds through further issuances of equity or convertible debt securities, our existing

SoFi Technologies, Inc.

stockholders could suffer significant dilution and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

We are required to serve as a source of financial strength for SoFi Bank, which is subject to minimum capital requirements imposed by federal regulators, which means that we may be required to provide capital or liquidity support to SoFi Bank, even at times when we may not have the resources to provide such support.

In addition, maintaining adequate liquidity is crucial to our securities brokerage, including key functions such as transaction settlement, custody requirements and margin lending.

Our broker-dealer subsidiary, SoFi Securities, is subject to Rule 15c3-1 under the Exchange Act, which

SoFi Technologies, Inc.

specifies minimum capital requirements intended to ensure the general financial soundness and liquidity of broker-dealers, and SoFi Securities is subject to Rule 15c3-3 under the Exchange Act, which requires broker-dealers to maintain certain liquidity reserves.

Our broker-dealer subsidiary, SoFi Securities, is subject to Rule 15c3-1 under the Exchange Act, which specifies minimum capital requirements intended to ensure the general financial soundness and liquidity of broker-dealers, and SoFi Securities is subject to Rule 15c3-3 under the Exchange Act, which requires broker-dealers to maintain certain liquidity reserves.

We meet our liquidity needs primarily from working capital, deposits and cash generated by member activity, as well as from external debt and equity financing.

3 unchanged sentences

We expect that we will continue to use our available cash to fund our lending activities and help scale our Financial Services segment.

To supplement our cash resources, we may seek to enter into additional securitizations and whole loan sale agreements or increase the size of existing debt warehousing facilities, increase the size of, or replace, our revolving credit facility, continue to grow deposits and pursue other potential options.

To supplement our cash resources, we may seek to enter into additional securitizations and whole loan sale agreements and Loan Platform Business origination and sale agreements or increase the size of existing debt warehousing facilities, increase the size of, or replace, our revolving credit facility, continue to grow deposits and pursue other potential options.

In addition, a reduction in our liquidity position could impair our technology platform clients’ confidence in us and our platform as a service products and services, many of which require capital investments and ongoing platform maintenance by us, which could result in decisions by our technology platform clients to terminate or not renew their existing contracts or to not add new products to their account.

4 unchanged sentences

We have the option of pursuing a gain-on-sale origination model, the success of which is tied to our ability to finance the assets that we originate.

Certain of our assets, however, are ineligible for sale to a whole loan buyer or securitization trust, or are ineligible for, or are subject to a lower advance rate under, warehouse funding, each of which has specific eligibility criteria for receivables it purchases or holds as collateral.

Certain of our assets, however, are ineligible for sale to a whole loan buyer, Loan Platform Business counterparty or securitization trust, or are ineligible for, or are subject to a lower advance rate under, warehouse funding, each of which has specific eligibility criteria for receivables it purchases or holds as collateral.

Ineligible receivables include, among others, those in default or that are delinquent, receivables with defects in their origination or servicing, including fraud, or receivables generated under origination guidelines and credit policies that are no longer in effect.

In addition, many of our warehouse funding sources contain excess concentration limits for loans in forbearance or with specific loan level characteristics such as time-to-maturity or loan type.

Once these limits have been exceeded, the advance rate applied to those receivables becomes less advantageous to us.

In addition, many of our warehouse funding sources and certain of our Loan Platform Business arrangements contain excess concentration limits for loans in forbearance or with specific loan level characteristics such as time-to-maturity or loan type.

Once these limits have been exceeded, the advance rate applied to those receivables becomes less advantageous to us or, under such Loan Platform Business arrangements, we are prohibited from selling such loans to the relevant counterparty.

If we are unable to sell or reasonably fund these receivables, we are required to hold them on our consolidated balance sheet which, in sufficient volume, negatively impacts our financial condition.

SoFi Technologies, Inc.

In addition to the receivables described above, we also hold on our consolidated balance sheet certain risk retention assets with respect to which we have a reduced ability to receive financing.

4 unchanged sentences

However, revenue growth for checking and savings is dependent on increasing the volume of members who open an account and on growing balances in those accounts.

Although our checking and savings account product has grown since its introduction in the first quarter of 2022, there is no

SoFi Technologies, Inc.

guarantee that account openings and the amount on deposit in those accounts will continue to grow.

In addition, although we have invested in a number of initiatives to attract new checking and savings account holders and capture a greater share of our members’ savings, including offering a competitive annual percentage yield on deposits and offering SoFi Plus membership benefits to deposit holders, there can be no assurance that these investments to acquire and retain members, provide differentiated features and services and spur usage of our deposit account product will be effective or cost effective.

Although our checking and savings account product has grown since its introduction in the first quarter of 2022, there is no guarantee that account openings and the amount on deposit in those accounts will continue to grow.

In addition, although we have invested in a number of initiatives to attract new checking and savings account holders and capture a greater share of our members’ savings, including offering a competitive annual percentage yield on deposits and offering SoFi Plus membership benefits to certain deposit holders, there can be no assurance that these investments to acquire and retain members, provide differentiated features and services and spur usage of our deposit account product will be effective or cost effective.

There are also no assurances that we will be able to maintain a competitive annual percentage yield on deposits, and members can easily transfer checking and savings account balances to our competitors.

5 unchanged sentences

In October 2024, we expanded our credit card program by launching two new credit cards:

SoFi Everyday Cash Rewards and SoFi Essential.

The performance of these new credit cards and the existing SoFi Unlimited 2% Credit Card products is significantly dependent on the ability of the credit and fraud decisioning and scoring models we use to originate the product, which includes a variety of factors, to effectively prevent fraud, evaluate an applicant’s credit profile and likelihood of default.

SoFi Everyday Cash Rewards and SoFi Essential, and in December 2025, we launched the SoFi Smart Card, a charge card secured by the member’s SoFi Checking and Savings Account.

The performance of these new credit cards and the existing SoFi Unlimited 2% Credit Card product is significantly dependent on the ability of the credit and fraud decisioning and scoring models we use to originate the product, which includes a variety of factors, to effectively prevent fraud, evaluate an applicant’s credit profile and likelihood of default.

Despite establishing a defined risk appetite and leveraging third-party stress testing of product loss forecasts, there is no assurance that our credit criteria can accurately predict repayment and loss profiles.

If our criteria do not accurately prevent fraud or reflect credit risk on the SoFi Credit Card products, greater than expected losses may result and our business, operating results, financial condition and prospects could be materially and adversely affected.

In addition, revenue growth for the SoFi Credit Card program is dependent on increasing the volume of members who open an account and on growing loan balances on those accounts.

Over time we will continue to invest in a number of new product initiatives to attract new SoFi Credit Card members and capture a greater share of our members’ total spending and borrowings.

Revenue growth for SoFi Credit Card may be adversely affected by new restrictions on credit card fees finalized by the CFPB in March 2024.

Although originally scheduled to become effective in May 2024, the rule was challenged in the 5th U.S.

Circuit Court of Appeals following a stay order from that court.

In December 2024, a federal judge rejected the CFPB’s request to reinstate the credit card late fee cap, effectively ending the CFPB’s attempt to enforce the cap.

With the change to the U.S.

presidential administration in January 2025 and the possible reshaping of the CFPB under new leadership, the CFPB may not continue litigating in favor of the cap, or enforce the cap.

If the CFPB’s rule were to become effective as written, it could, if we modify our terms in response to changes made by issuers impacted by the rule, adversely affect revenue.

The operation of our rewards program for the SoFi Unlimited 2% Credit Card and the SoFi Everyday Cash Rewards could have a negative impact on the revenue for our Credit Card program.

In December 2024, the CFPB published a Consumer Financial Protection Circular, which warned that the CFPB is scrutinizing and taking actions against operators of credit card reward programs, and declared it may be unlawful to devalue earned rewards, use fine print to disclose conditions for earning or redeeming rewards, or change the benefits for which rewards may be earned and redeemed.

This guidance could make it more expensive to operate the rewards program and limit our ability to adapt the program to changing economic conditions.

The success of the SoFi Credit Card program is also dependent on our ability to grow revenue which is, in turn, dependent on increasing the volume of members who open an account and on growing loan balances on those accounts.

Over time we will continue to invest in a number of new product initiatives to attract new SoFi Credit Card members and capture a greater share of our members’ total spending and borrowings, including through rewards programs.

However, the operation of our rewards program for certain of the SoFi Credit Card products could have a negative impact on the revenue for our Credit Card program.

In addition, revenue growth for SoFi Credit Card may also be adversely affected by proposed restrictions on credit card interest.

On January 9, 2026, President Trump announced his intent to fulfill a campaign promise to cap credit card interest at 10.00% for one year, to be effective on January 20, 2026, though no formal executive order or proposed rule was issued at that time.

Although the proposed cap on credit card interest may provide opportunities in other segments of our business, if enforced, it would likely adversely impact the SoFi Credit Card program.

The proposal currently faces an unclear enforcement path and significant industry opposition, with many questioning whether it would actually reduce credit availability for consumers.

While we have generally seen increases in revenue from SoFi Credit Card, there can be no assurance that our investments in SoFi Credit Card to acquire members, provide differentiated features and services and spur usage of our cards will continue to be effective, and developing our service offerings and forming new partnerships could have higher costs than anticipated, and could adversely impact our results or dilute our brand.

SoFi Technologies, Inc.

Furthermore, the success of the SoFi Credit Card products depends on our ability to execute on our funding strategy for the resulting credit card receivables.

2 unchanged sentences

In the event we are unable to finance our credit card receivables, we may be required to hold those assets on our consolidated balance sheet or sell them for a loss, either of which could have a negative impact on our business, operating results and financial condition.

SoFi Technologies, Inc.

Regulatory, Tax and Other Legal Risks

17 unchanged sentences

For example, Galileo’s provision of technology services to SoFi Bank is subject to Regulation W, including the requirement that the arrangement is on market terms.

If we fail to comply with the requirements of Sections 23A and 23B of the Federal Reserve Act and Regulation W for any reason, we may be subject to significant penalties, including substantial civil fines, mandatory consent orders, restrictions on SoFi Bank’s activities and, potentially, be required to divest subsidiaries.

The laws, rules, regulations, and supervisory guidance and policies applicable to us are subject to regular modification and change, including increased regulation as a result of the turmoil in the banking industry.

2 unchanged sentences

Section 1075 of the Dodd-Frank Act, which is commonly known as the “Durbin Amendment”, amended the Electronic Fund Transfer Act to restrict the amount of interchange fees that may be charged and prohibit network exclusivity for debit card transactions.

SoFi Bank is required to comply with the restrictions on interchange fees that went into effect on July 1, 2023, which may negatively impact future interchange fees we collect.

SoFi Bank is required to comply with the restrictions on interchange fees that went into effect on July 1, 2023, which may negatively impact future interchange fees we

SoFi Technologies, Inc.

In addition, in November 2023, the Federal Reserve proposed changes to the regulations implementing the Electronic Fund Transfer Act that would further restrict the amount of interchange fees that may be charged and require biennial reviews of those fees.

Guidance from regulators of SoFi Bank can subject its non-bank affiliates to increased governance.

Furthermore, guidance from regulators of the Company and SoFi Bank can subject its non-bank affiliates to increased governance.

For example, the OCC’s guidance on retail non-deposit investment products, or RNDIPs, applies to referral arrangements that SoFi Bank may have with an affiliate, including SoFi Securities.

This guidance, which was further updated in June 2024 to align with the SEC’s Regulation BI, requires that banks implement and maintain effective oversight and monitoring of relevant RNDIP arrangements to ensure that, among other things, sales transactions and recommendations to retail investors comply with SEC regulations.

Changes in laws, rules, regulations and supervisory guidance and policies could, among other things, subject us to

SoFi Technologies, Inc.

additional costs, including costs of compliance;

In addition, our platform as a service activities engaged in through our Technology Platform, are subject to increased regulatory governance by the Federal Reserve, including related to anti-money laundering and sanctions compliance obligations, because Galileo and Technisys are non-bank subsidiaries of a bank holding company.

Changes in laws, rules, regulations and supervisory guidance and policies could, among other things, subject us to additional costs, including costs of compliance;

limit the types of financial services and products we may offer;

1 unchanged sentence

Failure to comply with laws, regulations, policies, or supervisory guidance could result in enforcement and other legal actions by federal and state authorities, including criminal and civil penalties, the loss of FDIC insurance, revocation of a banking charter or registration as a broker-dealer and investment adviser, other sanctions by regulatory agencies, civil money penalties, and/or reputational damage, which could have a material adverse effect on our business, financial condition, and results of operations.

Finally, we intend to continue to explore other products for SoFi Bank over time.

Some of those products may require, or be deemed to require, additional data, procedures, partnerships, regulatory approvals, or capabilities that we have not yet obtained or developed.

Should we fail to expand and evolve SoFi Bank products in a successful manner, or should these new products, or new regulations or interpretations of existing regulations, impose requirements on us that are cumbersome or that we cannot satisfy, our business may be materially and adversely affected.

Congress, the Trump administration, or any new administration may make substantial changes to fiscal, tax, and other federal policies that may adversely affect our business.

The Trump administration has called for significant changes to U.S.

trade, healthcare, immigration and government regulatory policy and has begun implementing policy changes at a rapid pace.

Finally, we have recently introduced and intend to continue to explore other products for SoFi Bank over time, including digital assets and blockchain products, and expect to expand SoFi Bank’s product offering internationally.

Certain of those products and international activities may require, or be deemed to require, additional data, procedures, partnerships, regulatory approvals, or capabilities that we have not yet obtained or developed.

Should we fail to expand and evolve SoFi Bank products and activities in a successful manner, or should these new products, or new regulations or interpretations of existing regulations, impose requirements on us that are cumbersome or that we cannot satisfy, our business may be materially and adversely affected.

Congress, the U.S.

Presidential administration, or any new administration may make substantial changes to fiscal, tax, and other federal policies that may adversely affect our business.

The current U.S.

Presidential administration has made and continues to call for significant changes to U.S.

trade, healthcare, immigration and government regulatory policy and has implemented policy changes at a rapid pace.

Changes to U.S.

policy implemented by the U.S.

Congress, the Trump administration or any new administration have impacted among other things, the U.S.

Congress, the current U.S.

Presidential administration or any new administration have impacted among other things, the U.S.

and global economy, international trade relations, unemployment, immigration, healthcare, taxation, the U.S.

regulatory environment, inflation and other areas.

regulatory environment, inflation, defense and other areas.

Although we cannot predict the impact, if any, of these changes to our business, they could adversely affect our business.

1 unchanged sentence

Failure to comply with applicable laws, regulations or commitments, or to satisfy our regulators’ supervisory expectations, could subject us to, among other things, supervisory or enforcement action, which could adversely affect our business, financial condition and results of operations.

If we do not comply with applicable laws, regulations or commitments, including SoFi Bank’s operating agreement, if we are deemed to have engaged in unsafe or unsound conduct, or if we do not satisfy our regulators’ supervisory expectations, then we may be subject to increased scrutiny, supervisory criticism, governmental or private litigation and/or a wide range of potential monetary penalties or consequences, enforcement actions, criminal liability and/or reputational harm.

If we do not comply with applicable laws, regulations or commitments, if we are deemed to have engaged in unsafe or unsound conduct, or if we do not satisfy our regulators’ supervisory expectations, then we may be subject to increased scrutiny, supervisory criticism, governmental or private litigation and/or a wide range of potential monetary penalties or consequences, enforcement actions, criminal liability and/or reputational harm.

Such actions could be public or of a confidential nature, and arise even if we are acting in good faith or operating under a reasonable interpretation of the law and could include, for example, monetary penalties, payment of damages or other monetary relief, restitution or disgorgement of profits, directives to take remedial action or to cease or modify practices, restrictions on growth or expansionary proposals, denial or refusal to accept applications, removal of officers or directors, prohibition on dividends or capital distributions, increases in capital or liquidity requirements and/or termination of SoFi Bank’s deposit insurance.

1 unchanged sentence

Any failure to comply with applicable laws, regulations or commitments could have an adverse effect on our business, financial condition and results of operations.

An inability to accept or maintain deposits due to market demand or regulatory constraints could materially adversely affect our liquidity position and our ability to fund our business.

SoFi Technologies, Inc.

An inability to accept or maintain deposits due to regulatory constraints could materially adversely affect our liquidity position and our ability to fund our business.

SoFi Bank accepts deposits and uses the proceeds as a source of funding, with our direct retail deposits becoming a larger proportion of our funding over time.

Although we launched the SoFi Insured Deposit Program in 2023, whereby funds (up to $2 million) are deposited into deposit accounts at banks which are insured by the FDIC up to the applicable limits, we continue to face strong competition with regard to deposits, and pricing and product changes may adversely affect our ability to attract and retain cost-effective deposit balances.

To the extent we offer higher interest rates to attract or maintain deposits, our funding costs will be adversely impacted.

Our ability to obtain deposit funding and offer competitive interest rates on deposits is also dependent on SoFi Bank’s capital levels.

Our deposit product has several features designed to attract consumers, including competitive interest rates, the availability of the SoFi Insured Deposit Program, whereby funds (up to $3 million) are deposited into deposit accounts at banks which are insured by the FDIC up to the applicable limits, and SoFi Plus rewards opportunities.

Despite these features, we continue to face strong competition with regard to deposits, and our ability to accept and maintain deposit funding and offer competitive interest rates on deposits is dependent on, among other things, SoFi Bank’s capital levels.

The FDIA’s brokered deposit provisions and related FDIC rules in certain circumstances prohibit banks from accepting or renewing brokered deposits and apply other restrictions, such as a cap on interest rates that can be paid.

For example, while SoFi Bank met the definition of “well-capitalized” as of December 31, 2025 and currently has no restrictions regarding acceptance of brokered deposits or setting of interest rates, there can be no assurance that we will continue to meet this definition.

In July 2024, the FDIC proposed a rule which, if finalized as proposed, would expand the types of deposits that would be considered “brokered deposits” and we could be subject to these restrictions.

Additionally, our regulators can adjust

Additionally, our regulators can adjust applicable capital requirements at any time and have authority to place limitations on our deposit business.

An inability to attract or maintain deposits in the future due to regulatory constraints could materially adversely affect our ability to fund our business.

Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on borrower behavior, our student loan portfolios and our student loan origination volume.

Recent and evolving changes to federal student loan laws, regulations, and Department of Education policies—including material changes adopted in 2025 and scheduled to take effect in 2026—could adversely affect our student loan-related businesses (including origination, refinancing, servicing, collections, and ancillary products) by changing borrower repayment behavior, demand for refinanced student loan and other student loan credit products, and broader economic trends, and could materially impact our financial condition and results of operations.

In particular, recent developments include (i) significant legislative changes enacted in 2025 that are expected to restructure aspects of federal borrowing and repayment beginning July 1, 2026, including the introduction of a new income-driven repayment option (commonly described as a “Repayment Assistance Plan”), changes to borrowing limits and program design, and the elimination of the GRAD Plus program, (ii) continued policy and litigation-driven disruption associated with the Biden administration SAVE repayment plan, including Department of Education actions tied to court injunctions and subsequent program transitions, and (iii) changes to federal default and involuntary collection practices, including a recently announced pause on wage garnishment and tax refund offsets for certain borrowers in default while the Department of Education implements repayment system changes.

The Department of Education has also finalized additional program regulations with effective dates in 2026 (including regulations affecting Public Service Loan Forgiveness).

These developments—and any further changes adopted by Congress, the Department of Education, the CFPB, or the courts—may increase uncertainty and volatility in borrower behavior and the economics of both federal and private student loan products.

For example, modifications to repayment options, forgiveness eligibility, and default collection policies may change borrowers’ incentives to refinance federal loans into private loans;

reduce demand for our products;

increase prepayment or extension risk;

and shift delinquency, default, and cure patterns in ways that are difficult to predict.

Similarly, although it may appear that the elimination of the GRAD Plus federal loan program will increase demand for our private student loan product, there is no guarantee that this will occur.

In addition, program changes may increase operational complexity (including system updates, borrower communications, and training), elevate complaint volume and regulatory scrutiny, and heighten litigation and enforcement risk—particularly if borrowers experience payment shocks, confusion regarding plan transitions, or disputes over eligibility and servicing practices.

Because the scope, implementation timing, and interpretation of these changes remain uncertain—and could be further modified through additional rulemaking, sub-regulatory guidance, appropriations actions, or court decisions—we may be required to make rapid changes to products, underwriting, servicing, loss mitigation, and compliance processes, and we may incur increased costs to do so.

Any failure to timely and effectively adapt, or any adverse effect on borrower performance, demand, or competitive dynamics, could materially and adversely affect our business, reputation, results of operations, and financial condition.

Furthermore, these policy shifts may influence the overall financial well-being and creditworthiness of individuals carrying student debt.

For example, the replacement of multiple income-driven repayment options with narrower alternatives, changes to forgiveness eligibility, and increased default collection activity could raise monthly payment burdens or accelerate delinquency for certain borrowers, potentially reducing consumer spending, increasing financial stress, or altering borrowing patterns.

In addition, uncertainty around future student loan policy—such as ongoing litigation, shifting program eligibility criteria, or potential future reforms—may affect borrower confidence and decision-making.

These conditions could lead to

SoFi Technologies, Inc.

applicable capital requirements at any time and have authority to place limitations on our deposit businesses.

An inability to attract or maintain deposits in the future could materially adversely affect our ability to fund our business.

Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on our student loan portfolios and our student loan origination volume.

Legislative and regulatory actions have had and could continue to have a significant impact on our student loan refinancing business.

On March 27, 2020, the CARES Act was signed into law.

In compliance with the CARES Act, payments and interest accrual on all loans owned by the U.S.

Department of Education were initially suspended through September 30, 2020, a pause on student loan repayments that was subsequently extended through August 30, 2023 by a series of executive actions.

Interest on federal student loans began accruing on September 1, 2023 and borrowers’ first loan payments were due in October 2023.

Although federal student loans are back in repayment, the increased focus in recent years by policymakers on outstanding federal student loans, including, among other things, on the total volume of outstanding loans and on the number of loans outstanding per borrower, has led to discussion of additional potential legislative and regulatory actions and other possible steps to, among other things:

• permit private education loans such as our refinanced student loan and in-school student loan products to be discharged in bankruptcy without the need to show undue hardship;

• amend the federal postsecondary education loan programs, including to reduce interest rates on certain loans, to revise repayment plans, to make income-driven repayment plans more attractive to borrowers, to implement broader loan forgiveness plans, to provide for refinancing of private education loans into federal student loans at low interest rates, to reduce or eliminate the Grad PLUS program (which authorizes loans that comprise a substantial portion of our student loan refinancing business) and to provide for refinancing of existing federally held student loans into new federal student loans at low interest rates;

• require private education lenders to reform loan agreements to provide for income-driven repayment plans and other payment plans;

• make sweeping changes to the entire cost structure and financial aid system for higher education in the U.S., including proposals to provide free postsecondary education.

In addition, there is pressure on policymakers to reduce or cancel student loans or accrued interest at a significant scale, which would further reduce demand for our student loan refinancing product and have a negative impact on our loan origination volume and revenue.

For example, despite legal challenges at the Supreme Court to some of the Biden Administration’s prior student loan forgiveness measures, the Biden Administration subsequently continued to pursue options for providing relief to student borrowers.

However, in December 2024, the U.S.

Department of Education withdrew proposed rules seeking to provide student loan debt forgiveness for borrowers experiencing financial hardship and terminated three Program Integrity and Institutional Quality issues, which would have would have allowed the U.S.

Secretary of Education to cancel student loans for several groups of borrowers, including those who had been in repayment for decades and others experiencing financial hardship, and could have reduced or eliminated the education debts of millions of Americans.

In addition, the change of administration in January 2025 has brought uncertainty to the future of student debt relief programs and the U.S.

Department of Education.

The future impact to our student loan refinancing product will also largely depend on expectations regarding the introduction or implementation of these or any additional relief measures, the interest rate environment, how competitive our student loan refinancing products are compared to our competitors and macroeconomic factors.

If in the future, student loans were forgiven or canceled in any meaningful scale, or if federal loan borrowers were permitted to refinance at lower interest rates, our student loan refinancing business within our Lending segment, which is our largest segment, would be materially and adversely affected and our profitability, results of operations, financial condition, cash flows or future business prospects could be materially and adversely affected as a result.

variations in demand for consumer financial products, increased credit risk, or changes in macroeconomic consumption patterns that negatively impact our business operations, loan portfolios, liquidity, or financial results.

Finally, although repayment requirements for federal student loans have resumed since October 2023, following multiple extensions of the CARES Act’s pause on student loan repayments, which began in March 2020, and despite current uncertainty as to the future of the Department of Education itself and to prior policy proposals related to student debt relief and federal student loan programs, policymakers continue to face political pressure to reduce or cancel student loans or accrued interest at a significant scale.

If this political pressure results in the revival of any student debt relief policy proposals, it could reduce demand for our student loan refinancing product and have a negative impact on our loan origination volume and revenue.

If in the future, student loans were forgiven or canceled in any meaningful scale, or if federal loan borrowers were permitted to refinance at lower interest rates, our student loan refinancing business within our Lending segment would be materially and adversely affected and our profitability, results of operations, financial condition, cash flows or future business prospects could be materially and adversely affected as a result.

In addition, proposals to make student loans dischargeable in bankruptcy or similar proposals could make whole loan purchasers less likely to purchase our student loans, securitization investors less likely to purchase securities backed by our student loans or warehouse lenders less likely to lend against our student loans at attractive advance rates.

1 unchanged sentence

Although we continue to evaluate the ultimate impact of local, state and federal legislation, regulation and politics, guidance and actions, future legislative, regulatory and executive actions, and the ongoing impact of our own forbearance measures on our financial results, business operations and strategies, there is no guarantee that our estimates will be accurate or that any actions we take based on such estimates will be successful.

Furthermore, we believe that the cost of responding to, and complying with, evolving laws and regulations, as well as any guidance from enforcement actions, will continue to increase, as

SoFi Technologies, Inc.

will the risk of penalties and fines from any enforcement actions that may be imposed on our businesses.

Furthermore, we believe that the cost of responding to, and complying with, evolving laws and regulations, as well as any guidance from enforcement actions, will continue to increase, as will the risk of penalties and fines from any enforcement actions that may be imposed on our businesses.

Our profitability, results of operations, financial condition, cash flows or future business prospects could be materially and adversely affected as a result.

If we fail to comply with federal and state consumer protection laws, rules, regulations and guidance, our business could be adversely affected.

The CFPB, an agency which oversees compliance with and enforces federal consumer financial protection laws, has supervisory authority over the offer, sale or provision of our consumer financial products and services.

Prior to January 1, 2024, the OCC examined SoFi Bank for compliance with CFPB rules and enforced CFPB rules with respect to SoFi Bank.

In addition, to the extent certain of our lending or loan servicing activity was conducted outside of SoFi Bank, the CFPB had the authority to pursue enforcement actions against us as a company offering those certain consumer financial products or services.

Beginning January 1, 2024, SoFi Bank and its affiliates became subject to supervision and regulation by the CFPB with respect to federal consumer protection laws, including laws relating to fair lending and the prohibition of UDAAP in connection with the offer, sale or provision of consumer financial products and services.

As part of its regulatory oversight, the CFPB may seek a range of remedies, including rescission of contracts, refund of money, return of real property, restitution, disgorgement of profits or other compensation for unjust enrichment, damages, public notification of the violation and “conduct” restrictions (i.e., future limits on the target’s activities or functions).

Under the Biden administration, the CFPB pursued a more aggressive enforcement policy with respect to a range of regulatory compliance matters.

For example, on January 6, 2022, the CFPB announced a new initiative to scrutinize so-called consumer “junk fees.” Since then, the CFPB issued guidance to banks on how to avoid charging unlawful overdraft and depositor fees, confirmed their policy against “pay to pay” fees or charging any fees not expressly authorized and properly disclosed in a consumer agreement, issued a final rule limiting credit card penalty fees, which was stayed pending ongoing litigation, and launched an inquiry into junk fees in mortgage closing costs.

The CFPB has also identified additional unfair, deceptive, and abusive acts or practices that could violate the CFPA, including certain billing and collection practices after bankruptcy discharges of certain student loan debt, taking unreasonable advantage of a consumer’s reasonable reliance on an operator or lead generator to act in the consumer’s interests, and including unclear or unenforceable terms and conditions in consumer contracts or fine print.

The CFPB has also focused on student borrower harms from servicing failures, program disruptions, college banking and credit card agreements, and a variety of illegal practices and has been active in litigation against student loan servicers and others, including Climb Credit and its largest shareholder 1/0, Ejudicate, Navient, Prehired, the National Collegiate Student Loan Trusts and Pennsylvania Higher Education Assistance Agency, Western Benefits Group, Student Loan Pro and its owner, Judith Noh, and Performant Recovery, Inc.

for CFPA and other violations.

Increased enforcement or rules from the CFPB could increase our legal and financial compliance costs, require us to evaluate or amend certain activities or products in light of evolving compliance standards, make some activities more difficult, time-consuming and costly, and increase demand on our systems and resources.

In addition, the change of administration in January 2025 has brought uncertainty as to the future of the CFPB and the aggressiveness of its enforcement policies.

We hold lending licenses or similar authorizations in multiple states, each of which has the authority to supervise and examine our activities.

As a licensed consumer lender, mortgage lender, loan broker, collection agency, Money Services Business (“MSB”) and loan servicer in certain states, we are subject to examinations by state agencies in those states.

Similarly, we are subject to licensure requirements and regulations as an education loan servicer in multiple states.

An administrative proceeding, litigation, investigation or regulatory proceeding relating to allegations or findings of the violation of such laws by us, any sub-servicer we engage, or our collection agents, could impair our ability to service and collect on our loans or could result in requirements that we pay damages, fines or penalties and/or cancel the balance or other amounts owing under one or more of our loans.

There is no assurance that allegations of violations of the provisions of applicable federal or state consumer protection laws will not be asserted against us, any sub-servicers or collection agents we engage or other prior owners of our loans in the future.

To the extent it is determined that any of our loans were not originated in accordance with all applicable laws, we may be obligated to repurchase such loan from a whole loan buyer, securitization trust or warehouse facility.

We must comply with federal, state and local consumer protection laws including, among others, the federal and state UDAAP laws, the Federal Trade Commission Act, the Truth in Lending Act, the CRA, the Real Estate Settlement Procedures Act, the ECOA, the FHA, the HMDA, the Secure and Fair Enforcement for Mortgage Licensing Act, FCRA, the Fair Debt Collection Practices Act, the Servicemembers Civil Relief Act, the Military Lending Act, the Electronic Fund Transfer Act, the GLBA, the CARES Act and the Dodd-Frank Act.

We must comply with federal, state and local consumer protection laws including, among others, the federal and state UDAAP laws, the Federal Trade Commission Act, the Truth in Lending Act, the CRA, the Real Estate Settlement Procedures Act, the ECOA, the FHA, the HMDA, the Secure and Fair Enforcement for Mortgage Licensing Act, FCRA, state law versions of the Fair Debt Collection Practices Act, the Servicemembers Civil Relief Act, the Military Lending Act, the Electronic Fund Transfer Act, the GLBA, the CARES Act and the Dodd-Frank Act.

We must also comply with laws on advertising, as well as privacy laws, including the TCPA, the Telemarketing Sales Rule, the CAN-SPAM Act, the Personal Information Protection and Electronic Documents Act, applicable laws and regulations of Hong Kong including the Personal Data (Privacy) Ordinance and the Personal Data (Privacy) (Amendment) Ordinance 2012 and the CCPA and other state privacy laws.

2 unchanged sentences

Compliance with applicable laws is costly, and our failure to comply with applicable federal, state and local laws could lead to:

SoFi Technologies, Inc.

• loss of our licenses and approvals to engage in our lending and servicing businesses;

6 unchanged sentences

• loss or restriction of warehouse facilities to fund loans;

• loss of Loan Platform Business counterparties and whole loan purchasers to purchase loans;

• inability to raise capital;

• inability to execute on our business strategy, including our growth plans.

The CRA, to which SoFi Bank is subject, presents a useful example of how a failure to comply with applicable laws could hamper our growth.

SoFi Technologies, Inc.

For example, we rely on a variety of direct marketing techniques, including email and telephone marketing.

These activities are regulated by legislation such as the CAN-SPAM Act and TCPA.

Any failure by us to comply fully with the CAN-SPAM Act and/or TCPA may leave us subject to substantial fines and penalties.

In addition, any future restrictions in laws such as the CAN-SPAM Act and TCPA, and various United States state laws, or new federal laws regarding marketing and solicitation or international data protection laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies.

If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

The CRA, to which SoFi Bank is subject, presents another useful example of how a failure to comply with applicable laws could hamper our growth.

On January 1, 2023, SoFi Bank began operating under a five-year CRA strategic plan which includes measurable goals relating to:

(i) CD Lending and CD Investments, (ii) CD Contributions, (iii) CD Services, (iv) Small Business Lending, and (v) Retail Services and Products.

On October 23, 2023, the Federal Reserve, OCC and FDIC approved changes to their CRA regulations, maintaining the existing CRA ratings (Outstanding, Satisfactory, Needs to Improve, and Substantial Noncompliance) but modifying the evaluation framework to replace the existing tests generally applicable to banks with at least $2 billion in assets (the lending, investment, and services tests) with four new tests and associated performance metrics.

The new CRA regulations, which become effective on January 1, 2026, increase the geographic areas in which banks will be evaluated for CRA performance and may be particularly burdensome on banks focused on mobile and digital banking such as SoFi Bank.

The implementation of the new CRA regulations is currently paused pending the resolution of legal challenges to the new regulations.

The OCC’s assessment of our compliance with the CRA is taken into account when evaluating any application we submit for, among other things, a merger or the acquisition of another financial institution.

Our failure to satisfy our CRA obligations could, at a minimum, result in the denial of such applications and limit our growth.

In the first quarter of 2019, we were subject to a consent order from the FTC (the “FTC Consent Order”), which resolved allegations that we misrepresented how much money student loan borrowers have saved or would save from financing their loans with us, in violation of the Federal Trade Commission Act.

In addition, SoFi Bank and its affiliates are subject to supervision and regulation by the CFPB, an agency which oversees compliance with and enforces federal consumer financial protection laws, with respect to federal consumer protection laws, including laws relating to fair lending and the prohibition of UDAAP in connection with the offer, sale or provision of consumer financial products and services.

Under the Biden administration, the CFPB pursued an aggressive enforcement policy with respect to a range of regulatory compliance matters.

For example, on January 6, 2022, the CFPB announced an initiative to scrutinize so-called consumer “junk fees.” Since then, the CFPB has issued guidance to banks on how to avoid charging unlawful overdraft and depositor fees, confirmed their policy against “pay to pay” fees or charging any fees not expressly authorized and properly disclosed in a consumer agreement, issued a final rule limiting credit card penalty fees, which was stayed pending ongoing litigation, and launched an inquiry into junk fees in mortgage closing costs.

Notably, the CFPB rescinded guidance on substantially all of these topics in May 2025.

However, the positions taken in the now-rescinded guidance still represent potentially valid interpretations of existing law, which may be enforced or pursued by the CFPB or other federal or state regulators, or private plaintiffs, now or in the future.

The CFPB previously focused on student borrower harms from servicing failures, program disruptions, college banking and credit card agreements, and a variety of illegal practices and has been active in litigation against student loan servicers and others, including Climb Credit and its largest shareholder 1/0, Ejudicate, Navient, Prehired, the National Collegiate Student Loan Trusts and Pennsylvania Higher Education Assistance Agency, Western Benefits Group, Student Loan Pro and its owner, Judith Noh, and Performant Recovery, Inc.

for CFPA and other violations.

Increased enforcement or rules from the CFPB could increase our legal and financial compliance costs, require us to evaluate or amend certain activities or products in light of evolving compliance standards, make certain activities more difficult, time-consuming and costly, and increase demand on our systems and resources.

Furthermore, we hold lending licenses or similar authorizations in multiple states, each of which has the authority to supervise and examine our activities.

As a licensed consumer lender, mortgage lender, loan broker, collection agency, and loan servicer in certain states, we are subject to examinations by state agencies in those states.

Similarly, we are subject to licensure requirements and regulations as an education loan servicer in multiple states.

To the extent it is determined that any of our loans were not originated in accordance with all applicable laws, we may be obligated to repurchase such loan from a whole loan buyer, Loan Platform Business counterparty, securitization trust or warehouse facility.

While we have developed and monitor policies and procedures designed to assist in compliance with laws and regulations, no assurance can be given that our compliance policies and procedures will be effective and that we will not be subject to fines and penalties.

For example, in 2019, we were subject to a consent order from the FTC (the “FTC Consent Order”), which resolved allegations that we misrepresented how much money student loan borrowers have saved or would save

SoFi Technologies, Inc.

from financing their loans with us, in violation of the Federal Trade Commission Act.

Under the FTC Consent Order, we are prohibited from misrepresenting to consumers how much money they would save by using our products, unless the claims are backed up by reliable evidence.

Ambiguities in applicable statutes and regulations may leave uncertainty with respect to permitted or restricted conduct and may make compliance with laws, and risk assessment decisions with respect to compliance with laws, difficult and uncertain.

2 unchanged sentences

To resolve issues raised in examinations or other governmental actions, we may be required to take various corrective actions, including changing certain business practices, making refunds or taking other actions that could be financially or competitively detrimental to us.

In some cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals or make a settlement payment to a given party or regulatory body.

In certain cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals or make a settlement payment to a given party or regulatory body.

There is no assurance that any future settlements will not have a material adverse effect on our business.

We hold state licenses that result in substantial compliance costs, and our business would be adversely affected if our licenses are impaired as a result of noncompliance with those requirements.

We currently hold state licenses in connection with our lending activities, student loan servicing activities, securities business, and prior MSB activities.

We currently hold state licenses in connection with our lending activities, student loan servicing activities, and securities business.

Although we have transitioned our lending products to SoFi Bank, for as long as SoFi Lending Corp.

originates, brokers, purchases or master services or services loans, we must comply with certain state licensing requirements and varying compliance requirements.

In addition, although we have transferred our digital assets business and relinquished our state money transmitter licenses, we still hold our MSB license.

Changes in licensing laws may result in

SoFi Technologies, Inc.

increased disclosure requirements, increased fees, or may impose other conditions to licensing that we or our personnel are unable to meet.

In most states in which we operate, a regulatory agency or agencies regulate and enforce laws relating to loan servicers, brokers, and originators, collection agencies, and MSBs.

brokers, purchases or master services or services loans, we must comply with certain state licensing requirements and varying compliance requirements.

Changes in licensing laws may result in increased disclosure requirements, increased fees, or may impose other conditions to licensing that we or our personnel are unable to meet.

In most states in which we operate, a regulatory agency or agencies regulate and enforce laws relating to loan servicers, brokers, and originators, and collection agencies.

We are subject to periodic examinations by state and other regulators in the jurisdictions in which we conduct business, which can result in increases in our administrative costs and refunds to borrowers of certain fees earned by us, and we may be required to pay substantial penalties imposed by those regulators due to compliance errors, or we may lose our license or our ability to do business in the jurisdiction otherwise may be impaired.

7 unchanged sentences

States may also expand or otherwise modify their current regulations and if such states so act, we may not be able to comply with such updated regulations or maintain all requisite licenses and permits in such states or our costs of compliance with and maintenance of such licenses or permits may materially increase.

For example, California, Colorado and Maine have implemented additional regulations related to student loan servicers which impose additional registration, reporting and disclosure requirements and which, if applicable to us, may increase our costs of originating and servicing loans in those states.

In addition, the states that currently do not provide extensive regulation of our business may later choose to do so, and if such states so act, we may not be able to obtain or maintain all requisite licenses and permits, which could require us to modify or limit our activities in the relevant state or states.

3 unchanged sentences

We have devoted significant resources to developing our compliance and risk management policies and procedures and will continue to do so, but there can be no assurance these are sufficient, especially as our business is rapidly growing and evolving.

Nonetheless, our limited operating history in many of the products we offer, our evolving business and our rapid growth make it difficult to predict all of the risks and challenges we may encounter and may increase the risk that our policies and procedures that serve to identify, monitor and manage compliance risks may not be fully effective in mitigating our exposure in all market environments or against all types of risk.

Further, some controls are manual and are subject to inherent limitations and errors in oversight.

SoFi Technologies, Inc.

risks may not be fully effective in mitigating our exposure in all market environments or against all types of risk.

Further, certain controls are manual and are subject to inherent limitations and errors in oversight.

This could cause our compliance and other risk management strategies to be ineffective.

3 unchanged sentences

We are also exposed to heightened regulatory risk because our business is subject to extensive regulation and oversight in a variety of areas, and such regulations are subject to evolving interpretations and application and it can be difficult to predict how they may be applied to our business, particularly as we introduce new products and services and expand into new jurisdictions.

Additionally, the regulatory landscape involving digital assets is constantly evolving.

Although we have exited our digital assets business, the Company, including SoFi Digital Assets, LLC, may still be subject to regulatory scrutiny related to our prior business practices.

For example, the regulatory landscape involving digital assets is constantly evolving and we recently relaunched our digital assets offering.

Also, due to market volatility, it is difficult to predict how much capital we will need in the future to meet net capital requirements.

1 unchanged sentence

It is possible that these laws and regulations could be interpreted or applied in a manner that would prohibit, alter or impair our existing or planned products and services.

SoFi Technologies, Inc.

Regulatory scrutiny of banking as a service, or BaaS, solutions has increased and may require us to devote significant resources to enhancing our Technology Platform policies, procedures, operations, controls and products, and the failure to satisfy such increased scrutiny may cause regulators to take action against us or our BaaS partners, or result in a loss of one or more of our BaaS partners.

1 unchanged sentence

In addition, our Technology Platform offers an end-to-end core banking platform solution with integrated payment processing.

Furthermore, in connection with our Technology Platform's BaaS solutions, we sometimes offer certain program management, data, analytics, compliance and risk management functions.

Furthermore, in connection with our Technology Platform's BaaS solutions, we sometimes offer certain program management, data, analytics, compliance and risk management functions, including managing anti-money laundering and fraud risks.

The third parties that use these BaaS solutions include a variety of financial entities, including banks, fintech companies and other financial intermediaries.

2 unchanged sentences

Recently, regulators have even brought enforcement actions against financial entities that have allegedly not adequately addressed these concerns while growing their BaaS offerings.

Regulators have specifically required these financial entities to enhance oversight of third-party fintech partnerships, improve control frameworks related to anti-money laundering and Bank Secrecy Act compliance, and adopt, implement and adhere to revised and expanded risk-based policies, procedures and processes.

Regulators have specifically required these financial entities to enhance oversight of third-party fintech partnerships, improve control frameworks related to anti-money laundering and BSA compliance, and adopt, implement and adhere to revised and expanded risk-based policies, procedures and processes.

If we or any of the fintech clients or sponsor bank partners supported by our Technology Platform were to face regulatory actions that limit the growth of our or their fintech business, or if we were forced to stop growing our Technology Platform, or if any of our fintech clients or sponsor banks were to limit or cease their participation in BaaS solutions, this could have a negative impact on our revenue and results of operation for the Technology Platform segment.

4 unchanged sentences

Finally, as a subsidiary of a bank holding company, any failure of our Technology Platform's BaaS solutions to withstand regulatory scrutiny could reflect badly on our relationship with our regulators and on our overall reputation.

SoFi Technologies, Inc.

While we believe we are a leader in managing, monitoring and overseeing BaaS relationships with third parties and corresponding technologies, if we are not successful in continuing to enhance our controls for assessing and managing the third-party, anti-money laundering, fraud and information technology risks stemming from certain of our fintech and sponsor bank partnerships, we could be subject to additional regulatory scrutiny with respect to that portion of our business which could subject us to regulatory fines or other penalties, or business or reputational harm, and could adversely affect our financial condition and results of operations.

1 unchanged sentence

We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations;

however, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there were systems and procedures designed to ensure compliance in place at the time.

however, certain legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there were systems and procedures designed to ensure compliance in place at the time.

For example, we engage in outbound telephone and text communications with consumers, and accordingly must comply with a number of federal and state statutes and regulations that regulate certain such communications, including the TCPA and Telemarketing Sales Rules.

Federal Communications Commission (the “FCC”), and the FTC have responsibility for regulating various aspects of some of these federal laws.

Among other requirements, the TCPA requires us to obtain prior express written consent for certain telemarketing calls and to adhere to “do-not-call” registry requirements which, in part, mandate we maintain and regularly update lists of consumers who have chosen not to be called and restrict certain calls

SoFi Technologies, Inc.

to consumers who are on the national do-not-call list.

Federal Communications Commission (the “FCC”), and the FTC have responsibility for regulating various aspects of certain of these federal laws.

Further, in late 2023 and early 2024, the FCC introduced various new TCPA requirements relating to, among other things, lead generation, prior express written consent to marketing calls made with certain telephony technology and processing opt-outs and do not call requests.

These new requirements went into effect in January 2025.

In addition to federal laws, many states also have mini-TCPA and other similar consumer protection laws regulating certain telemarketing directed to their residents.

In addition to federal laws, many states also have mini-TCPA and other similar consumer protection laws regulating certain telemarketing calls directed to their residents.

Collectively, these federal and state laws limit our ability to communicate with consumers through calls and text messages and reduce the effectiveness of our marketing programs.

As currently construed, the TCPA and several state mini-TCPA laws do not distinguish between voice and data, and, as such, SMS/MMS messages are also “calls” for the purpose of these laws.

As construed by certain courts, the TCPA and certain state mini-TCPA laws do not distinguish between voice and data, and, as such, SMS/MMS messages are also “calls” for the purpose of these laws.

Other state mini-TCPA laws expressly include SMS/MMS messages within their scope.

For violations of the TCPA, the law provides for a private right of action under which a plaintiff may recover monetary statutory damages of $500 for each call or text made in violation of the statute.

A court may treble the $500 amount upon a finding of a willful or knowing violation.

There is no statutory cap on maximum aggregate exposure for TCPA violations (although some courts have applied in TCPA class actions constitutional limits on excessive penalties).

Like the TCPA, several mini-TCPA and other similar state laws also provide for a private right of action under which a plaintiff may recover statutory damages of $500 or more for each violative call or text and enhanced statutory if the violation is knowing or willful.

There is no statutory cap on maximum aggregate exposure for TCPA violations (although certain courts have applied in TCPA class actions constitutional limits on excessive penalties).

An action may be brought by the FCC, a state attorney general, an individual, or a class of individuals.

5 unchanged sentences

We have experienced an increase in such FCRA claims since our business has grown and even if we are ultimately successful in defending against such suits, they could involve substantial time and expense to analyze and respond to, could divert management’s attention and other resources from running our business, and could lead to settlements, judgments, fines, penalties or injunctive relief.

We are also subject to contractual requirements governing our use of credit reports established by the credit bureaus from whom we receive the reports.

If credit reporting data is accessed, used, disclosed, or retained in a manner that is inconsistent with those contractual requirements — whether due to employee misconduct, system error, third-party service provider failure, cyberattack, or otherwise — we could be subject to contractual claims, indemnification obligations, and remediation costs.

In addition, we could be required to suspend or limit access to certain data sources, which could adversely affect our underwriting, fraud prevention, marketing, or servicing

SoFi Technologies, Inc.

Any such event could also result in reputational damage, loss of consumer trust, adverse media coverage, increased compliance costs, and harm to our business, financial condition, and results of operations.

Changes in applicable laws and regulations, as well as changes in government enforcement policies and priorities, may negatively impact the management of our business, results of operations, ability to offer certain products or the terms and conditions upon which they are offered, and ability to compete.

8 unchanged sentences

These changes have in the past and may in the future require us to invest significant resources, and devote significant management attention, to make any necessary changes and could adversely affect our business.

For example, the SEC proposed Regulation Best Execution, along with other proposals related to equity market structure, in December 2022.

If adopted as proposed, Regulation Best Execution and other proposals would substantially alter existing order routing, execution incentives and business practices.

In March 2023, the SEC

SoFi Technologies, Inc.

proposed multiple rules related to privacy and cybersecurity.

The SEC’s proposed Rule 10 relating to cybersecurity for market entities (including broker-dealers) would impose additional requirements related to incident reporting, the establishment and periodic review of policies and procedures designed to address cybersecurity risks, and disclosure about cybersecurity risks and significant incidents.

On October 13, 2023, the SEC adopted rules relating to providing additional disclosures in the securities lending market.

For example, on October 13, 2023, the SEC adopted rules relating to providing additional disclosures in the securities lending market.

These rules require any covered person that loans a reportable security on behalf of itself or another person to report certain material terms of those loans and related information to FINRA by the end of the day on which the loan is effected.

1 unchanged sentence

These regulations could make securities lending more costly, leading to less overall lending activity and a decrease in revenue.

On February 22, 2024, the SEC adopted amendments to Rule 605 under Exchange Act that requires disclosures for order executions in national market system (“NMS”) stocks.

On February 22, 2024, the SEC adopted amendments to Rule 605 under the Exchange Act that requires disclosures for order executions in national market system (“NMS”) stocks.

The amendments modify the type of information required to be disclosed under Rule 605 and expand the scope of reporting entities subject to Rule 605 to include broker-dealers who introduce or carry 100,000 or more customer accounts.

Complying with Rule 605 is a new requirement for us.

In addition, the Rule itself has been modified to include new definitions, new and modified categories of order types, and new statistical measures of execution quality and other metrics.

In May 2024, the SEC adopted amendments to Regulation S-P (“Reg S-P”).

Modifications to Rule 605 include new definitions, new and modified categories of order types, and new statistical measures of execution quality and other metrics.

New execution quality reporting requires granular, public monthly reports, including fractional shares and stop orders.

Errors or unfavorable public metrics could harm our reputation and result in enforcement risk.

In May 2024, the SEC adopted amendments to Regulation S-P (“Reg S-P”) which went into effect for large covered institutions (including SEC-registered investment advisers with $1.5 billion in assets under management, investment companies with $1 billion in net assets and all broker-dealers that are not small institutions under the Exchange Act) in December 2025, and will go into effect for all other covered institutions in June 2026.

The finalized amendments to Reg S-P are designed to address the expanded use of technology and corresponding risks that have emerged since Reg S-P's original adoption and modernize and improve the protection of consumer financial information by certain financial institutions, also known as "covered institutions" (including broker-dealers and investment advisers).

2 unchanged sentences

and (iii) broadens the scope of information covered by Regulation S-P's requirements.

Failure to meet these obligations, or the failures of vendors on whom we rely, could lead to enforcement actions, litigation and significant costs.

On September 18, 2024, the SEC adopted rules that would (i) amend Rule 612 of Regulation NMS to establish a new minimum pricing increment, also known as a tick size, of $0.005 for the quoting of certain NMS stocks;

1 unchanged sentence

and (iii) accelerate the implementation of the round lot and odd-lot information definitions adopted in 2020 under the Market Data Infrastructure Rules (“MDI Rules”) and add information about the best odd-lot order to the definition of odd-lot information.

On December 20, 2024, the SEC adopted changes to SEC Rule 15c3-3 and 15c3-1 that modify how broker-dealers protect customer assets and calculate their minimum required “net capital.” These changes, particularly the amendments to Rule 612 and 610 of Regulation NMS, will likely affect the economics for orders executed on national stock exchanges and as a result may impact order routing and order execution decisions by market participants, including third parties on which we rely, like clearing brokers.

On December 20, 2024, the SEC adopted changes to SEC Rule

SoFi Technologies, Inc.

15c3-3 and 15c3-1 that modify how broker-dealers protect customer assets and calculate their minimum required “net capital.” These changes, particularly the amendments to Rule 612 and 610 of Regulation NMS, will likely affect the economics for orders executed on national stock exchanges and as a result may impact order routing and order execution decisions by market participants, including third parties on which we rely, like clearing brokers.

See “ Business, Financial and Operational Risks — We rely on third parties to perform certain key functions, and their failure to perform those functions could adversely affect our business, financial condition and results of operations ”.

15 unchanged sentences

Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect us in substantial and unpredictable ways.

SoFi Technologies, Inc.

changes could subject us to additional costs, limit the types of financial services and products it may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things.

Such changes could subject us to additional costs, limit the types of financial services and products it may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things.

Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations.

8 unchanged sentences

Our investment adviser and broker-dealer subsidiaries are subject to regulation by the SEC and FINRA.

We offer investment management services through SoFi Wealth which sponsors private investment funds that invest in asset-backed securitizations.

SoFi Wealth (the “Investment Adviser”) is registered as an investment adviser under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), which does not imply any level of skill or training, and is subject to regulation by the SEC.

SoFi Securities is an affiliated SEC-registered broker-dealer and FINRA member.

We offer investment management services through the Investment Adviser which offers investment management services in connection with our robo-advisory accounts.

The Investment Adviser is registered as an investment adviser under the Advisers Act, which does not imply any level of skill or training, and is subject to regulation by the SEC.

SoFi Securities is

SoFi Technologies, Inc.

an affiliated SEC-registered broker-dealer and FINRA member.

We offer cash management accounts, which are brokerage products, through SoFi Securities.

The Investment Adviser operates in a highly regulated environment and is subject to, among other things, the anti-fraud provisions of the Advisers Act and to fiduciary duties derived from these provisions that apply to its relationships with our members who are its advisory clients, as well as the funds managed by the Investment Adviser.

These provisions and duties also impose certain restrictions and obligations on us with respect to our dealings with our members, fund investors and our investments, including for example restrictions on transactions with our affiliates.

These provisions and duties also impose certain restrictions and obligations on us with respect to our dealings with our members and our investments, including for example restrictions on transactions with our affiliates.

Our Investment Adviser is also subject to other requirements under the Advisers Act and related regulations.

These additional requirements relate to matters including, among others, maintaining an effective and comprehensive compliance programs and record-keeping and reporting and disclosure requirements.

In recent years, the SEC proposed and, in some cases, adopted amendments to the Advisers Act rules, which present a number of additional significant and burdensome compliance challenges for registered investment advisers.

In recent years, the SEC proposed and, in certain cases, adopted amendments to the Advisers Act rules, which present a number of additional significant and burdensome compliance challenges for registered investment advisers.

In addition, our Investment Adviser has been in the past, and will be in the future, subject to SEC examination.

8 unchanged sentences

FINRA has adopted extensive regulatory requirements relating to sales practices, advertising, registration of personnel, compliance and supervision, and compensation and disclosure, to which SoFi Securities and its personnel are subject.

For example, FINRA’s 2026 Annual Regulatory Oversight Report included new topics, such as the third party risk landscape, extended hours trading, and registered index-linked annuities, and expanded guidance on AI, cybersecurity, AML/sanctions, and best execution/order routing disclosures, among others.

FINRA is explicitly focused on vendor outages and cyber incidents, generative AI-enabled fraud, and controls over fractional shares and after hours trading.

The SEC 2026 exam priorities also identify areas such as generative AI and Regulation Best Interest (“Reg BI”) as focus areas.

Our use of any AI-enabled tools could draw scrutiny, or failures in any of these areas could result in examination findings, sanctions or customer harm.

In addition, sales of complex products and account type recommendations face heightened enforcement under Reg BI.

Both the SEC and FINRA remain focused on surveilling off-channel communications and associated recordkeeping violations.

If associated persons use unapproved channels (e.g., personal messaging apps) and records are not preserved, we could face substantial penalties and remediation costs.

FINRA and the SEC also have the authority to conduct examinations of SoFi Securities and may also conduct administrative proceedings.

Additionally, material expansions of the business in which SoFi Securities engages are subject to approval by FINRA.

This could delay, or even prevent, the firm’s ability to expand its securities and brokerage offerings in the

SoFi Technologies, Inc.

This could delay, or even prevent, the firm’s ability to expand its securities and brokerage offerings in the future.

Furthermore, SoFi Securities is subject to increased governance in its role as an affiliate of a national bank under guidance from the OCC regarding RNDIPs.

6 unchanged sentences

For example, in December 2023, FINRA found that SoFi Securities failed to establish, maintain, and enforce a supervisory system reasonably designed to supervise its fully paid securities lending offerings.

Even if a sanction imposed against us or our personnel is small in monetary amount, the adverse publicity arising from the imposition of sanctions against us by regulators could harm our reputation and our brand and lead to material legal, regulatory and financial exposure (including fines and other penalties), cause us to lose existing members or fail to gain new members.

SoFi Technologies, Inc.

(including fines and other penalties), cause us to lose existing members or fail to gain new members.

In addition, in the normal course of business, SoFi Securities and the Investment Adviser discuss matters raised by its regulators during regulatory examinations or otherwise upon their inquiry.

These matters could also result in censures, fines, penalties or other sanctions.

In addition to the broker-dealer proposals described above under “ Changes in applicable laws and regulations, as well as changes in government enforcement policies and priorities, may negatively impact the management of our business, results of operations, ability to offer certain products or the terms and conditions upon which they are offered, and ability to compete ”, a substantial number of proposed rules for investment advisers were introduced in 2023 and 2024 and may be adopted or re-proposed this year.

These proposals cover material regulatory topics, including:

These withdrawn proposed rules covered material regulatory topics, including:

(i) environmental, social, and governance issues for investment advisers and funds;

(ii) outsourcing by investment advisers;

(iii) safeguarding and custody of client assets;

and (iv) expansion of the scope of activities and relationships that make a person an investment advice fiduciary under Section 3(21) of the Employee Retirement Income Security Act of 1974 and Section 4975 of the Internal Revenue Code.

If enacted, compliance with each of these proposed rules would impose additional costs on our business.

and (iii) safeguarding and custody of client assets.

A fourth proposed rule regarding expansion of the scope of activities and relationships that make a person an investment advice fiduciary under Section 3(21) of the Employee Retirement Income Security Act of 1974 and Section 4975 of the Internal Revenue Code (the “Retirement Security Rule”) was stayed by two Fifth Circuit federal district courts, and the Department of Labor (the “DOL”) decided not to appeal the decisions.

The DOL’s regulatory agenda for Spring 2025, however, included a new “fiduciary rule” set to be issued by May 2026.

If any of the foregoing rules is re-proposed and enacted, compliance would impose additional costs on our business.

There is also the risk that, despite our best efforts, the SEC does not view our compliance measures as sufficient.

This risk is substantially elevated where regulators adopt a substantial number of new rules in a short time frame.

We transferred our digital assets-related trading services to comply with regulations governing bank holding companies;

this transfer could adversely impact our member relationships and our reputation.

Until early 2024, we offered virtual currency and digital asset-related trading services through SoFi Digital Assets, LLC, a subsidiary licensed and registered with various governmental authorities as a MSB, money transmitter, virtual currency business or the equivalent.

In connection with our approval as a bank holding company in February 2022, the Federal Reserve determined that SoFi Digital Assets, LLC was engaged in certain digital asset-related activities that the Federal Reserve has not found to be permissible for a bank holding company under the Bank Holding Company Act and Regulation Y.

Section 4(a)(2) of the Bank Holding Company Act permitted us to continue our digital assets related offering for a two-year conformance period from the date we became a bank holding company.

In compliance with the requirement that we conform our activities to those permissible for a bank holding company, by the end of January 2024, we ceased offering digital-asset related trading services in all states.

We provided a majority of our members with the option to either close their digital asset account or migrate their digital assets accounts to Blockchain.com.

All transaction fees from any sales from digital assets accounts were reimbursed.

As part of our transfer of our digital asset-related activities we entered into a referral arrangement with Blockchain.com, and we have and may continue to enter into additional referral arrangements with other companies that can provide digital-asset related trading services to our members.

Although we do not expect the transfer of our digital asset-related activities or entry into the referral arrangements to have a material adverse impact on our business, results of operation or financial results, we cannot guarantee that our members will not experience a negative impact with respect to their digital asset positions.

Furthermore, there is no guarantee we will not face member dissatisfaction or litigation, or harm to our reputation, or adverse regulatory consequences, from such transfer of digital assets-related trading services.

Furthermore, if our prior digital asset-related trading services are the subject of regulatory scrutiny or enforcement actions, it could have a material adverse effect on our business, results of operations and reputation.

There has been a significant

SoFi Technologies, Inc.

amount of guidance, reports, and public statements issued by federal and state financial regulators regarding the legal permissibility of, and supervisory considerations relating to, financial institutions engaging in digital assets-related activities.

regulators, including the SEC, FinCEN, the CFTC, the IRS, and state regulators including the New York State Department of Financial Services, have made official pronouncements, pursued cases against businesses in the digital assets space or issued guidance or rules regarding the treatment of Bitcoin and other digital currencies.

Both federal and state agencies have instituted enforcement actions against those violating their interpretation of existing laws.

and many state agencies have offered little or incomplete official guidance regarding the treatment of digital assets.

If the SEC, CFTC or another federal or state regulator alleges that any assets we offered were securities or derivatives, or that we have violated any other federal or state securities or commodities law or regulation, we could face potential liability, including an enforcement action or private class action lawsuits, and face the costs of defending ourselves in the action, including potential fines, penalties, reputation harm, and potential loss of revenue.

See “ We may become subject to enforcement actions or litigation as a result of our failure to comply with laws and regulations, even though noncompliance was inadvertent or unintentional ”.

Failure to comply with anti-money laundering, economic and trade sanctions regulations, and similar laws could subject us to penalties and other adverse consequences.

4 unchanged sentences

The BSA requires banks and MSBs to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records, among other requirements.

State regulators may impose similar requirements on licensed money transmitters.

In addition, our contracts with financial institution partners and other third parties may contractually require us to maintain an anti-money laundering program.

SoFi Bank is subject to the regulatory and supervisory jurisdiction of the OCC with respect to the BSA and its implementing regulations applicable to banks.

Our subsidiary, SoFi Digital Assets, LLC, remains registered with FinCEN as an MSB.

Registration as an MSB subjects us to the regulatory and supervisory jurisdiction of FinCEN and the IRS, the anti-money laundering provisions of the BSA and its implementing regulations applicable to MSBs.

Although we have exited our digital assets business, the Company, including SoFi Digital Assets, LLC, may still be subject to regulatory scrutiny related to our prior business practices.

SoFi Bank is subject to the regulatory and supervisory jurisdiction of the OCC with respect to the BSA and its implementing regulations applicable to banks, and the Company and its non-bank subsidiaries, including our technology platform, are subject to the regulatory and supervisory jurisdiction of the Federal Reserve with respect to anti-money laundering and sanctions regulations.

We are also subject to economic and trade sanctions programs administered by OFAC, which prohibit or restrict transactions to or from or dealings with specified countries, their governments, and in certain circumstances, their nationals, and with individuals and entities that are specially-designated nationals of those countries, narcotics traffickers, terrorists or terrorist organizations, and other sanctioned persons and entities.

Our failure to comply with anti-money laundering, economic and trade sanctions regulations, and similar laws could subject us to substantial civil and criminal penalties, or result in the loss or restriction of our national bank charter, MSB or broker-dealer registrations and state licenses, or liability under our contracts with third parties, which may significantly affect our ability to conduct some aspects of our business.

Changes in this regulatory environment, including changing interpretations and the implementation of new or varying regulatory requirements by the government, may significantly affect or change the manner in which we currently conduct some aspects of our business.

Our failure to comply with anti-money laundering, economic and trade sanctions regulations, and similar laws could subject us to substantial civil and criminal penalties, or result in the loss or restriction of our national bank charter or broker-dealer registrations and state licenses, or liability under our contracts with third parties, which may significantly affect our ability to conduct certain aspects of our business.

We are subject to anti-corruption, anti-bribery and similar laws, and noncompliance with such laws can subject us to significant adverse consequences, including criminal or civil liability, and harm our business.

28 unchanged sentences

Compliance and trading problems or other deficiencies or weaknesses that are reported to regulators, such as the OCC, SEC, FINRA, the CFPB or state regulators, by dissatisfied customers or others, or that are identified by regulators themselves, are investigated by such regulators, and may, if pursued, result in formal claims being filed against us by customers or disciplinary action being taken against us or our employees by regulators or enforcement agencies.

In addition, we could be required to disclose such federal, state, or local government actions or court orders to the CFPB’s registry of corporate offenders that have broken consumer laws, which could be time-consuming and costly, increase our legal and compliance costs, increase demand on our systems and resources, and adversely impact our reputation.

In addition, we could be required to disclose such federal, state, or local government actions or court orders to others who have supervisory or enforcement authority over us, which could be time consuming and costly, increase demand on our systems and resources and adversely impact our reputation.

6 unchanged sentences

For example, a focus by regulators and lawmakers on PFOF, exchange rebates, and related conflicts of interest have resulted in new proposed rules.

Additionally, the SEC has proposed new requirements regarding best execution (Regulation Best Execution), PFOF and a rule to prohibit volume-based transaction pricing in connection with the execution of agency-related orders in national market system stock.

The SEC also issued an order in September 2023 directing the equity exchanges and FINRA to file a new national marketing system plan and the SEC is soliciting comments on the proposed national marketing system plan.

Additionally, the SEC has proposed new requirements regarding PFOF and a rule to prohibit volume-based transaction pricing in connection with the execution of agency-related orders in national market system stock.

The SEC also issued an order in September 2023 directing the equity exchanges and FINRA to file a new national marketing system plan, on which the SEC is soliciting comments.

This order and other proposals have the potential to substantially reshape U.S.

11 unchanged sentences

our policies and practices related to the collection, use, sharing, retention and safeguarding of consumer and/or employee information;

and some of our current or planned business activities.

and certain of our current or planned business activities.

New requirements, originating from new or amended laws, could also increase our costs of compliance and business operations and could reduce income from certain business initiatives.

This could increase our compliance costs, volatility in our customer base, and the risk of fraudulent access to consumers’ personal financial information.

The CFPB, for example, finalized its Personal Financial Data Rights Rule, which could require us to build an application that allows our customers to obtain their personal financial information and for authorized third parties to obtain our customers’ information and to implement privacy protections if we seek consumer financial data from another financial institution, as an authorized third party of a consumer.

Although the rule’s original compliance deadlines are currently stayed as part of ongoing litigation, and are not being enforced while the CFPB reconsiders the rule, if implemented this could increase our compliance costs, volatility in our customer base, and the risk of fraudulent access to consumers’ personal financial information.

Compliance with current or future privacy, information security and data protection laws (including those regarding security breach notification) affecting customer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve sharing information with third parties or storing sensitive credit card information), which could materially and adversely affect our profitability.

1 unchanged sentence

Additionally, there is always a danger that regulators can attempt to assert authority over our business in the area of privacy, information security and data protection.

Furthermore, if our vendors and/or service providers are or become subject to laws and regulations in the jurisdictions that have enacted more stringent and expansive legislation applicable to privacy, information and/or data protection, the costs that these vendors and service providers must incur in becoming compliant may be passed along to us, resulting in increasing costs on our business.

Furthermore, if our vendors and/or service providers are or become subject to laws and regulations in the jurisdictions that have enacted more stringent and expansive legislation applicable to

SoFi Technologies, Inc.

privacy, information and/or data protection, the costs that these vendors and service providers must incur in becoming compliant may be passed along to us, resulting in increasing costs on our business.

Concerns in our ability, perceived or otherwise, to protect the privacy and security of personal information may affect our ability to retain and engage new and existing members, clients, investors, and employees, and thereby affect our financial condition.

14 unchanged sentences

Although the UK is regarded as a third country under the EU GDPR, the EC has issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted.

The UK Government introduced a Data Protection and Digital Information Bill which failed in the UK legislative process.

A new Data (Use and Access) Bill (“UK Bill”) has been introduced into parliament.

If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK Adequacy Decision from the EC.

Further, this may lead to additional compliance costs and could increase our overall risk.

The Data (Use and Access) Act 2025 has been enacted in the UK which has the effect of altering the similarities between the UK and EEA data protection regime.

The EU has, however, extended the UK’s Adequacy Decision from the EC to December 27, 2031.

This may lead to additional compliance costs and could increase our overall risk.

Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection.

6 unchanged sentences

It is possible that these laws may be interpreted and applied in a manner that is inconsistent with laws in other jurisdictions or with our existing data management practices or the features of our services and platform capabilities.

We therefore cannot yet fully determine the impact existing and/or future laws, rules, regulations and industry standards may have on our business or operations.

We therefore cannot yet fully determine the impact existing and/or future laws, rules, regulations and industry

SoFi Technologies, Inc.

industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the imposition of significant fines, penalties or other liabilities.

standards may have on our business or operations.

Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the imposition of significant fines, penalties or other liabilities.

In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations.

14 unchanged sentences

The pursuit of a claim against a third party for infringement of our intellectual property could be costly, and there can be no guarantee that any such efforts would be successful.

In addition, our platform or those of third-party service providers that we utilize may infringe upon claims of third-party intellectual property, and we may face intellectual property challenges from such other parties.

In addition, our platform or those of third-party service providers that we utilize may infringe upon claims of third-party intellectual property, and we have and may continue to face intellectual property challenges from such other parties.

We may not be successful in defending against any such challenges or in obtaining licenses to avoid or resolve any intellectual property disputes, or in receiving amounts due to us under indemnification obligations from third-party service providers.

1 unchanged sentence

If we cannot protect our proprietary technology from intellectual property challenges, our ability to maintain our platform could be adversely affected.

Some aspects of our platform include open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Certain aspects of our platform include open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

We incorporate open source software into our proprietary platform and into other processes supporting our business.

2 unchanged sentences

courts, and there is a risk that such licenses could be construed in a manner that limits our use of the software, inhibits certain aspects of our platform and negatively affects our business operations.

Some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use.

If portions of our proprietary platform are determined to be subject to an open source license, or if the license terms for the open source software that we incorporate change, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our platform or change our business activities.

In addition to risks related to license requirements, the use of open source software can lead to greater

Certain open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use.

If portions of our proprietary platform are determined to

SoFi Technologies, Inc.

risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

be subject to an open source license, or if the license terms for the open source software that we incorporate change, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our platform or change our business activities.

In addition to risks related to license requirements, the use of open source software can lead to greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

Many of the risks associated with the use of open source software cannot be eliminated and could adversely affect our business.

29 unchanged sentences

federal, state and local and non-U.S.

tax authorities may interpret tax laws and regulations differently than we do and challenge tax positions that we have taken.

tax authorities may interpret tax laws and regulations differently than

SoFi Technologies, Inc.

we do and challenge tax positions that we have taken.

This may result in differences in the treatment of revenues, deductions, credits and/or differences in the timing of these items.

The differences in treatment may result in payment of additional taxes, interest or penalties that could have an adverse effect on our financial condition and results of operations.

Further, future

SoFi Technologies, Inc.

changes to U.S.

Further, future changes to U.S.

federal, state and local and non-U.S.

tax laws and regulations could increase our tax obligations in jurisdictions where we do business or require us to change the manner in which we conduct some aspects of our business.

tax laws and regulations could increase our tax obligations in jurisdictions where we do business or require us to change the manner in which we conduct certain aspects of our business.

Proposals to reform U.S.

28 unchanged sentences

This risk extends to our current employee population.

We also invest significant time and expense in engaging and developing our employees, which also increases their value to other companies that may seek to recruit them.

Turnover can result in significant replacement costs and lost productivity.

We also invest significant time and expense in engaging and developing our employees, which

SoFi Technologies, Inc.

also increases their value to other companies that may seek to recruit them.

Turnover can result in significant replacement costs and lost productivity.

In addition, from time to time, we implement organizational changes to pursue greater efficiency and realign our business and strategic priorities.

12 unchanged sentences

For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities.

Such security systems may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations.

Such security systems may be less secure than those used in our offices, which have in the past and may continue to subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations.

Additionally, employees who access company data and systems remotely may not have access to technology that is as robust as that in our offices, which could place additional pressure on our user infrastructure and third parties that are not easily mitigated.

14 unchanged sentences

This means that an outage of AWS could result in our system being unavailable for a significant period of time.

Terrorism, cyberattacks and other criminal, tortious or unintentional actions could also give rise to significant disruptions to our operations.

In addition, the long-term effects of climate change on the global economy and our industry in particular are unclear, however we recognize that there are inherent

Terrorism, cyberattacks and other criminal, tortious or

SoFi Technologies, Inc.

climate-related risks wherever business is conducted.

unintentional actions could also give rise to significant disruptions to our operations.

In addition, the long-term effects of climate change on the global economy and our industry in particular are unclear, however we recognize that there are inherent climate-related risks wherever business is conducted.

For example, our offices may be vulnerable to the adverse effects of climate change.

We have large offices located in the San Francisco Bay Area and Salt Lake City, Utah, regions that are prone to events such as seismic activity and severe weather, that have experienced and may continue to experience, climate-related events and at an increasing rate.

Examples include drought and water scarcity, warmer temperatures, wildfires and air quality impacts and power shut-offs associated with wildfire prevention.

The increasing intensity of drought throughout California and Utah and annual periods of wildfire danger increase the probability of planned power outages.

We have large offices located in the San Francisco Bay Area, Salt Lake City, Utah, and Jacksonville, Florida, regions that are prone to events such as seismic activity and severe weather, that have experienced and may continue to experience, climate-related events and at an increasing rate.

Examples include drought and water scarcity, hurricanes, warmer temperatures, wildfires and air quality impacts and power shut-offs associated with wildfire prevention and hurricanes.

The increasing intensity of drought throughout California and Utah and annual periods of wildfire danger, and the increasing intensity of hurricanes in Florida, increase the probability of planned power outages.

Although we maintain a disaster response plan and insurance, such events could disrupt our business, the business of our partners or third-party suppliers, and may cause us to experience losses and additional costs to maintain and resume operations.

4 unchanged sentences

We operate in an industry in which integrity and the confidence of our members is of critical importance.

We are subject to risks of errors and misconduct by our employees that could adversely affect our business, including:

We are subject to, and have experienced, risks of errors and misconduct by our employees that could adversely affect our business, including:

• engaging in misrepresentation or fraudulent activities when marketing or performing online brokerage and other services to our members;

16 unchanged sentences

The annual internal control assessment required by Section 404 of Sarbanes-Oxley has diverted, and may in the future divert, internal resources and we have and may experience higher operating expenses, higher independent auditor and consulting fees in the future.

To comply with the Sarbanes-Oxley Act, the requirements of being a reporting company under the Exchange Act and any new or revised accounting rules in the future, as necessary, we have, and may in the future further, work to upgrade the Company’s legacy information technology systems;

To comply with the Sarbanes-Oxley Act, the requirements of being a reporting company under the

SoFi Technologies, Inc.

Exchange Act and any new or revised accounting rules in the future, as necessary, we have, and may in the future further, work to upgrade the Company’s legacy information technology systems;

implement additional financial and management controls, reporting systems and procedures;

1 unchanged sentence

If we are unable to hire the additional accounting and finance staff necessary to comply with these requirements, we may need to retain additional outside consultants.

SoFi Technologies, Inc.

In addition, our current controls and any new controls that we develop may become inadequate because of poor design and changes in our business.

22 unchanged sentences

A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.

SoFi Technologies, Inc.

We incur significant costs and expend significant time and effort, as a result of operating as a public company, and our management is required to devote substantial time to compliance initiatives and corporate governance practices.

1 unchanged sentence

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Act, as well as rules adopted, and to be adopted, by the SEC and Nasdaq.

Our management and other personnel devote a substantial

SoFi Technologies, Inc.

amount of time to these risk management and compliance initiatives.

Furthermore, new rules and regulations or changes to existing rules and regulations in the future may increase our legal and financial compliance costs and make some activities more time-consuming and costly.

Our management and other personnel devote a substantial amount of time to these risk management and compliance initiatives.

Furthermore, new rules and regulations or changes to existing rules and regulations in the future may increase our legal and financial compliance costs and make certain activities more time-consuming and costly.

The impact of these requirements could also make it more difficult for us to attract and retain qualified persons to serve on our Board of Directors, its board committees or as executive officers.

4 unchanged sentences

Our risk management processes and procedures may not be effective.

Our risk management processes and procedures seek to appropriately balance risk and return and mitigate risks.

We have established processes and procedures intended to identify, measure, monitor and control the types of risk to which we are subject, including interest rate risk, credit risk, deposit risk, market risk, foreign currency exchange rate risk, liquidity risk, strategic risk, operational risk, cybersecurity risk, and reputational risk.

Our risk management system is defined in our Risk Governance Framework (“RGF”) and includes our risk culture philosophy and risk governance structure through which our Board and management align strategic planning, execution, performance measurement, and compensation decisions with our values, behaviors, and risk appetite.

Our RGF creates a consistent approach to how we identify, measure, monitor, and control the types of risk to which we are subject to, including interest rate risk, credit risk, deposit risk, market risk, foreign currency exchange rate risk, liquidity risk, strategic risk, operational risk and cybersecurity risk.

Credit risk is the risk of loss that arises when a loan obligor fails to meet the terms of a loan repayment obligation, the loan enters default, and if uncured results in financial loss of remaining principal and interest to the loan purchaser.

13 unchanged sentences

Cybersecurity risk is the risk of an unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, availability, or integrity of our systems and data, including, but not limited to, sensitive client data.

Our technology and cybersecurity teams rely on a layered system of preventive and detective technologies, controls, and policies to detect, mitigate, and contain cybersecurity threats.

In addition, our cybersecurity team, and the third-party consultants they engage, assess our cybersecurity risks and mitigation efforts.

Cyberattacks can also result in financial and reputational risk.

Reputational risk is the risk arising from possible negative perceptions of us, whether true or not, among our current and prospective members, clients, counterparties, employees, and regulators.

The potential for either enhancing or damaging our reputation is inherent in almost all aspects of business activity.

We attempt to manage this risk through our commitment to a set of core values that emphasize and reward high standards of ethical behavior, maintaining a culture of compliance, and by being responsive to member and regulatory requirements.

Our technology and cybersecurity teams rely on a layered system of preventive and detective technologies,

SoFi Technologies, Inc.

controls, and policies to detect, mitigate, and contain cybersecurity threats.

In addition, our cybersecurity team, and the third-party consultants they engage, assess our cybersecurity risks and mitigation efforts.

Cyberattacks have and may continue to result in financial and reputational risk.

Risk, including, but not limited to, the risks outlined above, is inherent in our business, and therefore, despite our efforts to manage risk, there can be no assurance that we will not sustain unexpected losses.

14 unchanged sentences

This guidance includes forward-looking statements based on projections prepared by our management.

Projections are based upon a number of assumptions and estimates that are based on information known when they are issued, and, while presented with numerical specificity, are inherently subject to significant business, economic and competitive uncertainties and contingencies relating to our business, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions, some of which will change.

Guidance is necessarily speculative in nature, and some or all of the assumptions underlying the guidance furnished by us may not materialize or may vary significantly from actual outcomes.

3 unchanged sentences

Information Technology and Data Risks

Cyberattacks and other security incidents and compromises could have an adverse effect on our business, harm our reputation and expose us to liability and adversely affect our ability to collect payments and maintain accurate accounts.

Cyberattacks and other security incidents and compromises could have an adverse effect on our business and systems, harm our brand and our reputation and expose us to liability.

Efforts to prevent and respond to these attacks and incidents are costly.

In the normal course of business, we collect, process and retain non-public and confidential information regarding our members, prospective members, technology platform clients and the customers of our technology platform clients.

We also have arrangements in place with certain third-party service providers that require us to share consumer information.

We likely will not be able to anticipate or prevent all security incidents or compromises even if we have implemented preventive measures, in which case there would be an increased risk of fraud or identity theft, and we have in the past and may

In the normal course of business, we collect, store, process and transmit non-public and confidential information regarding our members, prospective members, technology platform clients and the customers of our technology platform

SoFi Technologies, Inc.

in the future experience losses on, or delays in the collection of amounts owed.

Although we devote significant resources and management focus to work to ensure the integrity of our systems through information/cybersecurity and business continuity programs, our facilities and systems, and those of third-party service providers, have been and will likely continue to be targeted by external or internal threats.

We and our third-party service providers are at constant risk of cyber-attacks or cyber intrusions via viruses, worms, break-ins, malware, ransomware and other malicious software programs, phishing attacks, hacking, denial-of-service attacks or other attacks and similar disruptions from the unauthorized use of or access to computer systems (including from internal and external sources) that attack our products or otherwise exploit any vulnerabilities in our systems or those of our third-party service providers, or attempt to fraudulently induce our members, prospective members, technology platform clients and the customers of our technology platform clients, third-party service providers or others to disclose passwords or other sensitive information or unwittingly provide access to our systems or data.

clients, and employees and third-party service providers, as well as information required to access customer assets.

We also have arrangements in place with certain third-party service providers that require us to share consumer information.

We have built our reputation on the premise that we are helping members get their money right by offering a safe, secure way to store their money and build a financially sound future.

As a result, any actual or perceived security breach of us or our third-party partners have and may in the future:

• harm our reputation and brand;

• result in our systems or services being unavailable and interrupt our operations;

• result in improper disclosure of data and violations of applicable privacy and data protection laws;

• result in significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory, and financial exposure;

• cause us to incur significant remediation costs;

• lead to theft or irretrievable loss of our or our customers’ assets;

• reduce customer confidence in, or decrease customer use of, our products and services;

• divert the attention of management from the operation of our business;

• result in significant compensation or contractual penalties payable by us to our customers or third parties as a result of losses to them or claims by them;

• adversely affect our business, operating results, and financial condition.

Despite the implementation of security measures, our internal computer and information technology systems and infrastructure and those of our third-party service providers and other contractors and consultants upon which our business relies have experienced and are at constant risk of cyber-attacks or cyber intrusions via viruses, worms, break-ins, breakdown, wrongful intrusions, wrongful conduct by insider employees or vendors, malware, ransomware and other malicious software programs, attacks enhanced or facilitated by AI, social engineering (including phishing attacks), business email compromises, hacking, data breaches, denial-of-service attacks or other attacks and similar disruptions from the unauthorized use of or access to computer systems (including from internal and external sources) that attack our products or otherwise exploit any vulnerabilities in our systems or those of our third-party service providers, or attempt to fraudulently induce our members, prospective members, technology platform clients and the customers of our technology platform clients, employees, third-party service providers or others to disclose passwords or other sensitive information or unwittingly provide access to our systems or data.

Furthermore, these attempts to disrupt or gain unauthorized access to our and our third-party service providers’ information systems from malicious third parties or insider threats may incorporate widely varying and frequently changing tactics, which may be enhanced or facilitated by AI.

In addition, we expect the amount and sophistication of the perpetrators of these attacks to continue to expand, which could include nation-state actors.

Any such incident could lead to interruptions, delays or website outages, causing loss of critical data or the unauthorized disclosure or use of personally identifiable or other confidential information.

Such incidents have and could in the future lead to interruptions, delays or website outages, causing loss of critical data or the unauthorized disclosure or use of personally identifiable or other confidential information.

Cyberattacks continue to be prevalent and pervasive across industries, including in our industry, and such attacks on our systems and those of our third-party service providers have occurred in the past and are expected to occur in the future.

Security incidents or compromises could occur from outside our company, and also from the actions of persons inside our company who may have authorized or unauthorized access to our technology systems, despite our investment in security controls.

In addition, security threats may increase as a result of geopolitical events, such as in connection with escalating conflict in the Middle East and the ongoing war in Ukraine, and recent changes to the U.S.

presidential administration.

Security incidents, data breaches, or compromises could occur from outside our company, and also from the actions of persons inside our company who may have authorized or unauthorized access to our technology systems, despite our investment in security controls.

In addition, security threats may increase as a result of geopolitical events, such as in connection with the confrontation in Venezuela, the ongoing conflict in the Middle East and the ongoing war in Ukraine, and U.S.

government actions and policies and regulatory priorities.

These events could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, damage to our reputation and a loss of confidence in the security of our systems, products and services.

Although the impact to date from these events has not had a material adverse effect on us, no assurance is given that this will continue to be the case in the future.

Cybersecurity risks in the financial services industry have increased, in part because of new technologies, artificial intelligence, the use of the Internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized criminals, perpetrators of fraud, hackers, terrorists and others.

Cybersecurity risks in the financial services industry have increased, in part because of new technologies, AI, the use of the Internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized criminals, perpetrators of fraud, hackers, terrorists and others.

In addition to cyberattacks and other security incidents and compromises involving the theft of non-public and confidential information, hackers have engaged in attacks that are designed to disrupt key business services, such as consumer-facing websites.

We may not be able to anticipate or implement effective preventive measures against all security incidents and compromises, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources.

We employ detection and response mechanisms designed to contain and mitigate security incidents, but there are no assurances that these mechanisms will be effective and early detection efforts may be thwarted by sophisticated attacks and malware designed to avoid detection.

Despite our investments in detection strategy and a 24/7/365 security operations center, we also may fail to detect the existence of a security incident related to the information of our members.

The access by unauthorized persons to, or the improper disclosure by us of, confidential information regarding our members, prospective members, technology platform clients and the customers of our technology platform clients, or our proprietary information, software, methodologies and business secrets could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, damage to our reputation or a loss of confidence in the security of our systems, products and services, all of which could have a material adverse impact on our business.

We may not be able to anticipate or implement effective preventive measures against all security incidents, data breaches, and compromises, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources.

We employ detection and response mechanisms designed to contain and mitigate security

SoFi Technologies, Inc.

incidents, but there are no assurances that these mechanisms will be effective and early detection efforts may be thwarted by sophisticated attacks and malware designed to avoid detection.

Despite our investments in detection strategy and a 24/7/365 security operations center, we also may fail to detect the existence of a security incident or data breach related to the information of our members, prospective members, technology platform clients and the customers of our technology platform clients, and employees and third-party service providers.

The access by unauthorized persons to, or the improper disclosure by us of, confidential information regarding our members, prospective members, technology platform clients and the customers of our technology platform clients, employees and third-party service providers, or our proprietary information, software, methodologies and business secrets, could interrupt our business or operations, result in significant legal and financial exposure, supervisory liability, damage to our reputation or a loss of confidence in the security of our systems, products and services, all of which could have a material adverse impact on our business.

Because each loan that we originate involves, in part, our proprietary automated underwriting process, any failure of our computer systems involving our automated underwriting process and any technical or other errors contained in the software pertaining to our automated underwriting process could compromise our ability to accurately evaluate potential members, which could negatively impact our results of operations.

Furthermore, any failure of our computer systems could cause an interruption in operations and result in disruptions in, or reductions in the amount of, collections from the loans we make to our members.

Additionally, if threat actors were able to access our secure files, they might be able to gain access to the personal information of our members, prospective members, technology platform clients and the customers of our technology platform clients.

If we are unable to prevent such activity, we may be subject to significant liability, negative publicity and a material loss of members or technology platform clients, all of which may negatively affect our business.

In addition, there have in the past been a number of well-publicized attacks or incidents affecting companies in the financial services industry that have heightened concern by consumers, which could also intensify regulatory focus, cause users to lose trust in the security of the industry in general and result in reduced use of our services and increased costs, all of which could also have a material adverse effect on our business.

SoFi Technologies, Inc.

Further, the costs associated with a cyber attack or other security incident could materially adversely impact our cost of operations and our business.

In addition, a cybersecurity incident could result in increased cybersecurity and insurance costs, including higher premiums or reduced availability of coverage.

Any of the foregoing could materially and adversely affect our business, financial condition, and results of operations.

Our business is also subject to contractual obligations related to the protection, confidentiality, and security of data, including personal, financial, and confidential information belonging to our members, prospective members, technology platform clients and the customers of our technology platform clients, and employees and third-party service providers.

Many of our contracts contain data protection, confidentiality, indemnification, limitation of liability, and service-level provisions that could be triggered by a cybersecurity incident or data breach.

We have in the past experienced and may in the future experience a cyber breach and we may be required to indemnify technology platform clients or other counterparties for losses arising from the incident, provide credits, refunds, or other contractual remedies, or face claims for damages resulting from alleged failures to meet contractual security or availability commitments.

Certain contracts may also permit counterparties to terminate or suspend services, seek injunctive relief, or pursue other remedies following a data breach.

In addition, contractual liability arising from a cyber breach or other security incident could result in substantial defense costs, settlements, or judgments, as well as increased scrutiny during contract renewals or negotiations.

Our contractual protections, including limitations of liability, exclusions, and insurance coverage, may be insufficient to fully mitigate these risks or may not apply in all circumstances.

Any of the foregoing could materially and adversely affect our business, financial condition, and results of operations.

Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

The processing of personal data and implementation of new technologies could give rise to liabilities as a result of federal, state and international laws and regulations, as well as our failure to adhere to the privacy and data security practices that we articulate to our members.

1 unchanged sentence

There are federal, state, and foreign laws regarding privacy, data security and the collection, use, storage, protection, sharing and/or transmission of personal information and non-public data.

Additionally, many states continue to enact legislation on matters of privacy, information security, cybersecurity, data breach and data breach notification requirements.

Additionally, many states continue to enact legislation on matters of privacy, information security, cybersecurity, data breach and data breach

SoFi Technologies, Inc.

notification requirements.

For example, as of January 1, 2020, the CCPA granted additional consumer rights with respect to data privacy in California.

6 unchanged sentences

While we have made modifications to our data collection and processing practices and policies to comply with the CCPA, we cannot predict their impact on our business, operations or financial condition.

Laws similar to the CCPA have been passed in numerous other states, a number of which will enter into force in 2025.

Further, a number of other states have proposed new privacy laws, some of which would be comprehensive such as the CCPA and others which are more narrowly focused on particular types of data.

Laws similar to the CCPA have entered into force in numerous other states.

Further, a number of other states have proposed new privacy laws, certain of which would be comprehensive such as the CCPA and others which are more narrowly focused on particular types of data.

Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

Certain states have already passed laws regulating specific aspects of privacy.

For example, a small number of states, such as Washington, Illinois and Texas, have enacted laws that specifically target the collection and use of biometric information.

The existence of comprehensive privacy laws in different states in the country makes our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

In addition, laws in all 50 U.S.

3 unchanged sentences

Congress may in the future enact a comprehensive federal data privacy law to which we may likely become subject.

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security.

Regulators and legislators in the U.S.

are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries.

For example, Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, as implemented by Department of Justice regulations issued in December 2024, prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China.

The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls.

Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions and may result in exclusion from participation in federal and state programs.

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security, and we expect that there will continue to be new or amended laws, regulations, standards and obligations proposed and enacted in various foreign jurisdictions.

For example, the EU GDPR, the UK GDPR, various Latin American (“LATAM”) privacy laws such as Brazil’s Lei Geral de Proteção de Dados Pessoais (“LGPD”) and Argentina’s Ley de Protección de los Datos Personales (“PDPA”) impose strict requirements for the processing of personal data of individuals located, respectively, within the EEA, the UK and LATAM region.

2 unchanged sentences

Certain jurisdictions, such as the EU, Switzerland, the UK and LATAM have enacted cross-border personal data transfers laws regulating personal data flows to third countries.

For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to countries outside of the EEA, such as the United States, which the European Commission does not consider to be providing an adequate level of personal data protection.

The European Commission has issued standard contractual clauses for data transfers from controllers or processors in the EU (or otherwise subject to the EU GDPR) to controllers or processors established outside the EU.

For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to countries outside of the EEA, such as the United States, which the EC does not consider to be providing an adequate level of personal data protection.

The EC has issued standard contractual clauses for data transfers from controllers or processors in the EU (or otherwise subject to the EU GDPR) to controllers or processors established outside the EU.

The standard contractual clauses require exporters to assess the risk of a data transfer on a case-by-case basis, including an analysis of the laws in the destination country.

The UK is not subject to the European Commission’s standard contractual clauses but has published a UK-specific transfer mechanism, which enables transfers from the UK.

The UK is not subject to the EC’s standard contractual clauses but has published a UK-specific transfer mechanism, which enables transfers from the UK.

The UK-specific mechanism, the “International Data Transfer Agreement”, requires a similar risk assessment of the transfer as the standard contractual clauses.

Further, the EU and United States have adopted its adequacy decision for the EU-U.S.

Data Privacy Framework ("Framework"), which entered into force on July 11, 2023.

This Framework provides that the protection of personal data transferred between the EU and the United States is comparable to that offered in the EU.

Data Privacy Framework ("EU Framework"), which entered into force on July 11, 2023.

The EU Framework provides that the protection of personal data transferred between the EU and the United States is comparable to that offered in the EU.

This provides a further avenue to ensuring transfers to the United States are carried out in line with the EU GDPR.

There has been an extension to the Framework to cover UK transfers to the United States.

The Framework could be challenged like its predecessor frameworks.

This complexity and the additional contractual burden may increase our overall risk exposure.

In addition, laws in Switzerland and LATAM similarly restrict personal data transfers outside of those jurisdictions to countries such as the United States of America that do not provide an adequate level of personal data protection.

In addition to European restrictions on cross-border personal data transfers, other jurisdictions have enacted or are considering similar cross-border personal data transfer laws and

There has been an extension to the EU Framework to cover UK transfers to the United States and Switzerland has also agreed to a corresponding framework with the U.S.

recognizing an adequate level of protection for personal data transfers under the Swiss-U.S.

Data Privacy Framework.

SoFi Technologies, Inc.

local personal data residency laws, any of which could increase the cost and complexity of doing business.

These Frameworks could be challenged like predecessor frameworks.

This complexity and the additional contractual burden may increase our overall risk exposure.

In addition, laws in LATAM similarly restrict personal data transfers outside of those jurisdictions to countries such as the U.S.

that do not provide an adequate level of personal data protection.

In addition to European restrictions on cross-border personal data transfers, other jurisdictions have enacted or are considering similar cross-border personal data transfer laws and local personal data residency laws, any of which could increase the cost and complexity of doing business.

If we cannot implement a valid compliance mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or elsewhere.

Inability to import personal data to the United States may significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties subject to European and other data protection laws or requiring us to increase our personal data processing capabilities in Europe and/or elsewhere at significant expense.

Separately, as the regulatory framework for machine learning technology and AI evolves, new state laws and regulations are emerging, such as the Colorado AI Act which will go into effect on February 1, 2026, and California’s AB 2013, which requires generative AI developers to post information on their websites regarding the data used to train their AI systems.

It is possible that other new laws and regulations will be adopted in the near future, or that existing laws and regulations may be interpreted in ways that would affect our business and the ways in which we may use AI and machine learning technology, our financial condition and our results of operations, including as a result of the cost to comply with such laws or regulations.

For example, the EU’s Artificial Intelligence Act (“AI Act”) - the world’s first comprehensive AI law - entered into force on August 1, 2024 and, with some exceptions, will begin to apply as of August 2, 2026.

This legislation imposes significant obligations on providers and deployers of high-risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems.

If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific ethical, accountability, and administrative requirements, some of which may increase our costs and compliance obligations.

Inability to import personal data to the U.S.

may significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties subject to European and other data protection laws or requiring us to increase our personal data processing capabilities in Europe and/or elsewhere at significant expense.

Certain of our products and services are also subject to self-regulatory standards and industry certifications that may legally or contractually apply to us.

These include the Payment Card Industry Data Security Standards ("PCI-DSS"), AICPA, and Security Organization Control 2 ("SOC 2"), which apply to or are maintained by certain of our solutions.

In the event we fail to comply with the PCI-DSS or fail to maintain our SOC 2 certification, we could be in breach of our obligations under customer and other contracts, fines and other penalties could result, and we may suffer reputational harm and damage to our business.

Further, our customers may expect us to comply with more stringent privacy, data storage and data security requirements than those imposed by laws, regulations or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data.

Separately, the rapid evolution of AI will require the application of significant resources to design, develop, test and maintain our products and services to help ensure that AI is implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts.

As the regulatory framework for machine learning technology and AI evolves, new state laws and regulations are emerging and it is likely that other new laws and regulations will be adopted in the near future, or that existing laws and regulations may be interpreted in ways that would affect our business and the ways in which we may use AI and machine learning technology, our financial condition and our results of operations, including as a result of the cost to comply with such laws or regulations.

For example, the EU’s Artificial Intelligence Act (“AI Act”), the world’s first comprehensive AI law, entered into force on August 1, 2024 and, with certain exceptions, will begin to apply as of August 2, 2026.

As enacted, this legislation imposes significant obligations on providers and deployers of high-risk AI systems, and encourages providers and deployers of AI systems to account for EU ethical principles in their development and use of these systems.

If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific ethical, accountability, and administrative requirements, certain of which may increase our costs and compliance obligations.

Further, potential government regulation related to AI use and ethics may also increase the cost of research and development in this area, and failure to properly remediate AI usage or ethics issues may cause public confidence in AI to be undermined, which could slow adoption of AI in our products and services.

Likewise, in the U.S., the regulatory environment is complex and uncertain.

Presidential administration’s Executive Order "Ensuring a National Policy Framework for Artificial Intelligence," effective December 11, 2025, directed federal agency reviews of state AI laws and coordination between White House advisors and Congress to reach a legislative proposal for a uniform federal AI policy framework.

At the same time, several states, including Texas, Colorado and California, passed laws that regulate various facets of AI, certain of which have taken effect and will continue to take effect through 2026 and beyond.

These laws address a wide range of AI-related topics, including consequential decisions, transparency, training data, among others, and it remains unclear which requirements, if any, will be superseded by the Executive Order.

In addition, there continues to be uncertainty regarding the application of existing federal and state legal frameworks to uses and development of AI, and legal norms and market standards regarding AI continue to evolve.

If we develop or use AI systems that are governed by these laws or regulations, we will need to meet higher standards of data quality, transparency, and human oversight, and we would need to adhere to specific and potentially burdensome and costly ethical, accountability, and administrative requirements.

We may also be subject to significant enforcement or litigation in the event of any perceived non-compliance.

Any violations of these laws and regulations may require us to change our business practices or operational structure, including limiting our activities in certain states and/or jurisdictions, address legal claims, and sustain monetary penalties, reputational damage and/or other harms to our business.

1 unchanged sentence

If we fail to manage our third-party service providers or their relevant practices, or if they fail to meet any requirements with regard to data processing, privacy, data protection or cybersecurity required by applicable legal or contractual obligations that we face (including any applicable requirements of our clients), we may be liable in certain cases.

Legal obligations relating to privacy, cybersecurity and data protection may require us to manage our third-party service providers and their practices and to enter into agreements with them in certain cases.

Legal obligations relating to privacy, cybersecurity and data protection may require us to manage our third-

SoFi Technologies, Inc.

party service providers and their practices and to enter into agreements with them in certain cases.

We may face difficulties in binding our third-party service providers to these agreements and otherwise managing their relevant practices, which may subject us to claims, proceedings, and liabilities.

5 unchanged sentences

Our computer systems and third-party providers may encounter service interruptions at any time due to system or software failure or errors, employee misconfiguration of resources or misdirected communications, natural disasters, severe weather conditions, health pandemics, terrorist attacks, cyberattacks or other events.

For example, in September 2023, the SoFi Invest platform experienced a service interruption that resulted in some of our members being unable to view certain of their account information and unable to buy and sell securities and other financial products on our platform for a period of time.

For example, in September 2023, the SoFi Invest platform experienced a service interruption that resulted in certain of our members being unable to view certain of their account information and unable to buy and sell securities and other financial products on our platform for a period of time.

Any such events, including persistent interruptions or perceptions of such interruptions whether true or not, in our products and services could cause members to believe that our products and services are unreliable, leading them to switch to our competitors or to otherwise avoid our products and services, and otherwise have a negative effect on our business and technology infrastructure (including our computer network systems), which could lead to member dissatisfaction or long-term disruption of our operations.

Additionally, our insurance policies might be insufficient to

SoFi Technologies, Inc.

cover a claim made against us by any such members affected by any disruptions, outages, or other performance or infrastructure problems.

Additionally, our insurance policies might be insufficient to cover a claim made against us by any such members affected by any disruptions, outages, or other performance or infrastructure problems.

Additionally, our reliance on third-party providers may mean that we will not be able to resolve operational problems internally or on a timely basis, as our operations will depend upon such third-party service providers communicating appropriately and responding swiftly to their own service disruptions through industry standard best practices in business continuity and/or disaster recovery.

5 unchanged sentences

In addition, our ability to monitor third party services and service providers is limited, and so our ability to anticipate, detect, and remediate anomalies in those services is also more limited when compared to our internal systems monitoring.

Although our current use of artificial intelligence and machine learning is limited, our systems and those of our partners are increasingly reliant on artificial intelligence machine learning systems, which are complex and may have errors or inadequacies that are not easily detectable.

Although our current use of AI and machine learning is limited, our systems and those of our partners are increasingly reliant on AI machine learning systems, which are complex and may have errors or inadequacies that are not easily detectable.

These systems may inadvertently reduce the efficiency of our systems, or may cause unintentional or unexpected outputs that are incorrect, do not match our business goals, do not comply with our policies, or otherwise are inconsistent with our brands, guiding principles and mission.

Errors or breakdowns in our machine learning systems could also result in damage to our reputation, loss of members, loss of revenue or liability for damages, any of which could adversely affect our growth prospects and our business.

Further, bad actors around the world use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property.

Any of these effects could damage our reputation, result in the loss of valuable property and information, cause us to breach applicable laws and regulations and contractual obligations, and adversely impact our business.

We expect that new technologies and business processes applicable to the financial services industry will continue to emerge and that these new technologies and business processes may be better than those we currently use.

There is no assurance that we will be able to successfully adopt new technology as critical systems and applications become obsolete and better ones become available.

There is no assurance that we will be able to successfully adopt new technology as critical systems and applications become obsolete and

SoFi Technologies, Inc.

better ones become available.

A failure to maintain and/or improve current technology and business processes could cause disruptions in our operations or cause our solution to be less competitive, all of which could have a material adverse effect on our business.

4 unchanged sentences

• developments involving our competitors;

• changes in laws and regulations affecting our business, or changes in policies with respect to student loan forgiveness;

• changes in interest rates and inflation;

• changes in laws and regulations affecting our business, or changes in policies with respect to student loans;

• variations in our operating performance and the performance of our competitors in general;

5 unchanged sentences

• commencement of, or involvement in, litigation or regulatory enforcement investigations involving our company;

SoFi Technologies, Inc.

• the occurrence of an actual or perceived data or security breach;

• changes in our capital structure, such as future issuances of securities or the incurrence of additional debt, including in connection with acquisitions;

1 unchanged sentence

• volatility in capital markets and changes in the volume of shares of our common stock available for public sale;

• general economic and political conditions, such as the effects of recessions, interest rates, tariffs, inflation, consumer confidence and spending, public perception of the financial services industry, availability of loans and liquidity in the capital markets, local and national elections, corruption, political instability and acts of war or terrorism, including escalating conflict in the Middle East and the ongoing war in Ukraine, and policy- and regulatory-related changes resulting from the recent changes to the U.S.

presidential administration.

• general economic and political conditions, such as the effects of recessions, interest rates, tariffs, inflation, consumer confidence and spending, public perception of the financial services industry, availability of loans and liquidity in the capital markets, local and national elections, corruption, political instability and acts of war or terrorism, including the confrontation in Venezuela, the ongoing conflict in the Middle East and the ongoing war in Ukraine, and policy- and regulatory-related changes resulting from U.S.

government actions and policies and regulatory priorities.

These market and industry factors, as well as others, may materially reduce the market price of our common stock regardless of our operating performance.

11 unchanged sentences

Our share price may decline if our actual results do not match the projections of these research analysts.

In addition, if the market for technology stocks or financial services stocks or the broader stock market experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, financial condition or results of operations.

In addition, if the market for technology stocks or

SoFi Technologies, Inc.

financial services stocks or the broader stock market experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, financial condition or results of operations.

We may be subject to securities litigation, which is expensive and could divert management attention.

8 unchanged sentences

These sales, or the perception in the market that the holders of a large number of shares intend to sell shares, could cause the market price of our common stock to decline or increase the volatility in the market price of our common stock.

SoFi Technologies, Inc.

Our issuance of additional capital stock in connection with financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

15 unchanged sentences

These provisions could also limit the price that investors might be willing to pay in the future for shares of our common stock, and therefore depress the trading price of our common stock.

Additionally, these provisions could also make it difficult for stockholders to take certain actions, including electing directors who are not nominated by the current members of our Board of Directors or taking other corporate actions, including effecting changes in our management.

Additionally, these provisions could also make it difficult for stockholders to take certain actions, including electing directors who are not nominated by the current members of our Board of

SoFi Technologies, Inc.

Directors or taking other corporate actions, including effecting changes in our management.

Among other things, our organizational documents include provisions regarding:

5 unchanged sentences

These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in the Board of Directors or management of our company.

SoFi Technologies, Inc.

The provisions of our bylaws requiring exclusive forum in the Court of Chancery of the State of Delaware and the federal district courts of the United States for certain types of lawsuits may have the effect of discouraging certain lawsuits, including derivative lawsuits and lawsuits against our directors and officers, by limiting plaintiffs’ ability to bring a claim in a judicial forum that they find favorable.

7 unchanged sentences

Additionally, these forum selection clauses may limit our stockholders’ ability to bring a claim in a judicial forum that they find favorable for disputes with us or our directors, officers or employees, which may discourage the filing of lawsuits against us and our directors, officers and employees, even though an action, if successful, might benefit our stockholders.

In addition, while the Delaware Supreme Court and other states courts have upheld the validity of federal forum selection provisions purporting to require claims under the Securities Act be brought in federal court, there is still some uncertainty as to whether other courts will enforce our Federal Forum Provision.

In addition, while the Delaware Supreme Court and other states courts have upheld the validity of federal forum selection provisions purporting to require claims under the Securities Act be brought in federal court, there is still uncertainty as to whether other courts will enforce our Federal Forum Provision.

If the Federal Forum Provision is found to be unenforceable, we may incur additional costs associated with resolving such matters.

The Court of Chancery of the State of Delaware and the federal district courts of the United States may reach different judgments or results than would other courts, including courts where a stockholder considering an action may be located or would otherwise choose to bring the action, and such judgments may be more or less favorable to us than our stockholders.

SoFi Technologies, Inc.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors