SOFI

•successfully integrate our past and future acquisitions, including continuing to develop Wyndham’s technology, performing functions in home loans origination, such as home loans processing and underwriting, and managing the origination of new home loan types;

We may be unable to satisfactorily meet evolving standards, regulations and disclosure requirements related to ESG.

Galileo and Technisys revenue from clients is highly concentrated.

Further, if there were deficiencies in the oversight and control of our third-party relationships, and if our regulators held us responsible for those deficiencies, it could have an adverse effect on our business, reputation and results of operations.

For example, while we do not currently rely heavily on artificial intelligence, we expect to integrate more artificial intelligence into our technology in the future especially to improve the experience of our members.

Private education loans, including the refinanced student loans and other student loans made by us, are generally not dischargeable by a borrower in bankruptcy. However, a private education loan may be discharged if a debtor files an adversary claim and the bankruptcy court determines that not discharging the debt would impose an undue hardship on the debtor and the debtor’s dependents. For example, the Biden Administration gave judges more leeway to discharge student loans, resulting in more borrowers discharging their student loans in bankruptcy in 2023, compared to prior years. The discharge of a significant amount of our loans could adversely affect our business and results of operations.

In addition, in the acquisition of Wyndham, we also acquired

Although originally scheduled to become effective in May 2024, the rule was challenged in the 5th U.S. Circuit Court of Appeals following a stay order from that court. In December 2024, a federal judge rejected the CFPB’s request to reinstate the credit card late fee cap, effectively ending the CFPB’s attempt to enforce the cap. With the change to the U.S. presidential administration in January 2025 and the possible reshaping of the CFPB under new leadership, the CFPB may not continue litigating in favor of the cap, or enforce the cap. If the CFPB’s rule were to become effective as written, it could, if we modify our terms in response to changes made by issuers impacted by the rule, adversely affect revenue.

In December 2024, the CFPB published a Consumer Financial Protection Circular, which warned that the CFPB is scrutinizing and taking actions against operators of credit card reward programs, and declared it may be unlawful to devalue earned rewards, use fine print to disclose conditions for earning or redeeming rewards, or change the benefits for which rewards may be earned and redeemed. This guidance could make it more expensive to operate the rewards program and limit our ability to adapt the program to changing economic conditions.

Finally, we intend to continue to explore other products for SoFi Bank over time.

Although we launched the SoFi Insured Deposit Program in 2023, whereby funds (up to $2 million) are deposited into deposit accounts at banks which are insured by the FDIC up to the applicable limits, we continue to face strong competition with regard to deposits, and pricing and product changes may adversely affect our ability to attract and retain cost-effective deposit balances. To the extent we offer higher interest rates to attract or maintain deposits, our funding costs will be adversely impacted.

Our ability to obtain deposit funding and offer competitive interest rates on deposits is also dependent on SoFi Bank’s capital levels. In July 2024, the FDIC proposed a rule which, if finalized as proposed, would expand the types of deposits that would be considered “brokered deposits” and we could be subject to these restrictions.

Legislative and regulatory actions have had and could continue to have a significant impact on our student loan refinancing business. On March 27, 2020, the CARES Act was signed into law. In compliance with the CARES Act, payments and interest accrual on all loans owned by the U.S. Department of Education were initially suspended through September 30, 2020, a pause on student loan repayments that was subsequently extended through August 30, 2023 by a series of executive actions. Interest on federal student loans began accruing on September 1, 2023 and borrowers’ first loan payments were due in October 2023. Although federal student loans are back in repayment, the increased focus in recent years by policymakers on outstanding federal student loans, including, among other things, on the total volume of outstanding loans and on the number of loans outstanding per borrower, has led to discussion of additional potential legislative and regulatory actions and other possible steps to, among other things:

•permit private education loans such as our refinanced student loan and in-school student loan products to be discharged in bankruptcy without the need to show undue hardship;

•amend the federal postsecondary education loan programs, including to reduce interest rates on certain loans, to revise repayment plans, to make income-driven repayment plans more attractive to borrowers, to implement broader loan forgiveness plans, to provide for refinancing of private education loans into federal student loans at low interest rates, to reduce or eliminate the Grad PLUS program (which authorizes loans that comprise a substantial portion of our student loan refinancing business) and to provide for refinancing of existing federally held student loans into new federal student loans at low interest rates;

•require private education lenders to reform loan agreements to provide for income-driven repayment plans and other payment plans; and

•make sweeping changes to the entire cost structure and financial aid system for higher education in the U.S., including proposals to provide free postsecondary education.

In addition, there is pressure on policymakers to reduce or cancel student loans or accrued interest at a significant scale, which would further reduce demand for our student loan refinancing product and have a negative impact on our loan origination volume and revenue. For example, despite legal challenges at the Supreme Court to some of the Biden Administration’s prior student loan forgiveness measures, the Biden Administration subsequently continued to pursue options for providing relief to student borrowers. However, in December 2024, the U.S. Department of Education withdrew proposed rules seeking to provide student loan debt forgiveness for borrowers experiencing financial hardship and terminated three Program Integrity and Institutional Quality issues, which would have would have allowed the U.S. Secretary of Education to cancel student loans for several groups of borrowers, including those who had been in repayment for decades and others experiencing financial hardship, and could have reduced or eliminated the education debts of millions of Americans. In addition, the change of administration in January 2025 has brought uncertainty to the future of student debt relief programs and the U.S. Department of Education.

The future impact to our student loan refinancing product will also largely depend on expectations regarding the introduction or implementation of these or any additional relief measures, the interest rate environment, how competitive our student loan refinancing products are compared to our competitors and macroeconomic factors.

The CFPB, an agency which oversees compliance with and enforces federal consumer financial protection laws, has supervisory authority over the offer, sale or provision of our consumer financial products and services. Prior to January 1, 2024, the OCC examined SoFi Bank for compliance with CFPB rules and enforced CFPB rules with respect to SoFi Bank. In addition, to the extent certain of our lending or loan servicing activity was conducted outside of SoFi Bank, the CFPB had the authority to pursue enforcement actions against us as a company offering those certain consumer financial products or services. In addition, the change of administration in January 2025 has brought uncertainty as to the future of the CFPB and the aggressiveness of its enforcement policies.

On October 23, 2023, the Federal Reserve, OCC and FDIC approved changes to their CRA regulations, maintaining the existing CRA ratings (Outstanding, Satisfactory, Needs to Improve, and Substantial Noncompliance) but modifying the evaluation framework to replace the existing tests generally applicable to banks with at least $2 billion in assets (the lending, investment, and services tests) with four new tests and associated performance metrics. The new CRA regulations, which become effective on January 1, 2026, increase the geographic areas in which banks will be evaluated for CRA performance and may be particularly burdensome on banks focused on mobile and digital banking such as SoFi Bank. The implementation of the new CRA regulations is currently paused pending the resolution of legal challenges to the new regulations.

In addition, although we have transferred our digital assets business and relinquished our state money transmitter licenses, we still hold our MSB license.

Additionally, the regulatory landscape involving digital assets is constantly evolving. Although we have exited our digital assets business, the Company, including SoFi Digital Assets, LLC, may still be subject to regulatory scrutiny related to our prior business practices.

For example, the SEC proposed Regulation Best Execution, along with other proposals related to equity market structure, in December 2022. If adopted as proposed, Regulation Best Execution and other proposals would substantially alter existing order routing, execution incentives and business practices. In March 2023, the SEC proposed multiple rules related to privacy and cybersecurity. The SEC’s proposed Rule 10 relating to cybersecurity for market entities (including broker-dealers) would impose additional requirements related to incident reporting, the establishment and periodic review of policies and procedures designed to address cybersecurity risks, and disclosure about cybersecurity risks and significant incidents. Complying with Rule 605 is a new requirement for us. In May 2024, the SEC adopted amendments to Regulation S-P (“Reg S-P”).

We offer investment management services through SoFi Wealth which sponsors private investment funds that invest in asset-backed securitizations.

(ii) outsourcing by investment advisers; If enacted, compliance with each of these proposed rules would impose additional costs on our business. This risk is substantially elevated where regulators adopt a substantial number of new rules in a short time frame.

Until early 2024, we offered virtual currency and digital asset-related trading services through SoFi Digital Assets, LLC, a subsidiary licensed and registered with various governmental authorities as a MSB, money transmitter, virtual currency business or the equivalent. In connection with our approval as a bank holding company in February 2022, the Federal Reserve determined that SoFi Digital Assets, LLC was engaged in certain digital asset-related activities that the Federal Reserve has not found to be permissible for a bank holding company under the Bank Holding Company Act and Regulation Y. Section 4(a)(2) of the Bank Holding Company Act permitted us to continue our digital assets related offering for a two-year conformance period from the date we became a bank holding company. In compliance with the requirement that we conform our activities to those permissible for a bank holding company, by the end of January 2024, we ceased offering digital-asset related trading services in all states. We provided a majority of our members with the option to either close their digital asset account or migrate their digital assets accounts to Blockchain.com. All transaction fees from any sales from digital assets accounts were reimbursed. As part of our transfer of our digital asset-related activities we entered into a referral arrangement with Blockchain.com, and we have and may continue to enter into additional referral arrangements with other companies that can provide digital-asset related trading services to our members. Although we do not expect the transfer of our digital asset-related activities or entry into the referral arrangements to have a material adverse impact on our business, results of operation or financial results, we cannot guarantee that our members will not experience a negative impact with respect to their digital asset positions. Furthermore, there is no guarantee we will not face member dissatisfaction or litigation, or harm to our reputation, or adverse regulatory consequences, from such transfer of digital assets-related trading services.

Furthermore, if our prior digital asset-related trading services are the subject of regulatory scrutiny or enforcement actions, it could have a material adverse effect on our business, results of operations and reputation. There has been a significant amount of guidance, reports, and public statements issued by federal and state financial regulators regarding the legal permissibility of, and supervisory considerations relating to, financial institutions engaging in digital assets-related activities. Many U.S. regulators, including the SEC, FinCEN, the CFTC, the IRS, and state regulators including the New York State Department of Financial Services, have made official pronouncements, pursued cases against businesses in the digital assets space or issued guidance or rules regarding the treatment of Bitcoin and other digital currencies. Both federal and state agencies have instituted enforcement actions against those violating their interpretation of existing laws. Other U.S. and many state agencies have offered little or incomplete official guidance regarding the treatment of digital assets. If the SEC, CFTC or another federal or state regulator alleges that any assets we offered were securities or derivatives, or that we have violated any other federal or state securities or commodities law or regulation, we could face potential liability, including an enforcement action or private class action lawsuits, and face the costs of defending ourselves in the action, including potential fines, penalties, reputation harm, and potential loss of revenue. See “We may become subject to enforcement actions or litigation as a result of our failure to comply with laws and regulations, even though noncompliance was inadvertent or unintentional”.

State regulators may impose similar requirements on licensed money transmitters. SoFi Bank is subject to the regulatory and supervisory jurisdiction of the OCC with respect to the BSA and its implementing regulations applicable to banks. Our subsidiary, SoFi Digital Assets, LLC, remains registered with FinCEN as an MSB. Registration as an MSB subjects us to the regulatory and supervisory jurisdiction of FinCEN and the IRS, the anti-money laundering provisions of the BSA and its implementing regulations applicable to MSBs. Although we have exited our digital assets business, the Company, including SoFi Digital Assets, LLC, may still be subject to regulatory scrutiny related to our prior business practices.

This could increase our compliance costs, volatility in our customer base, and the risk of fraudulent access to consumers’ personal financial information.

The UK Government introduced a Data Protection and Digital Information Bill which failed in the UK legislative process. A new Data (Use and Access) Bill (“UK Bill”) has been introduced into parliament. If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK Adequacy Decision from the EC.

Our risk management processes and procedures seek to appropriately balance risk and return and mitigate risks.

Reputational risk is the risk arising from possible negative perceptions of us, whether true or not, among our current and prospective members, clients, counterparties, employees, and regulators. The potential for either enhancing or damaging our reputation is inherent in almost all aspects of business activity. We attempt to manage this risk through our commitment to a set of core values that emphasize and reward high standards of ethical behavior, maintaining a culture of compliance, and by being responsive to member and regulatory requirements.

We likely will not be able to anticipate or prevent all security incidents or compromises even if we have implemented preventive measures, in which case there would be an increased risk of fraud or identity theft, and we have in the past and may in the future experience losses on, or delays in the collection of amounts owed. Although we devote significant resources and management focus to work to ensure the integrity of our systems through information/cybersecurity and business continuity programs, our facilities and systems, and those of third-party service providers, have been and will likely continue to be targeted by external or internal threats.

Laws similar to the CCPA have been passed in numerous other states, a number of which will enter into force in 2025.

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. There has been an extension to the Framework to cover UK transfers to the United States.

Separately, as the regulatory framework for machine learning technology and AI evolves, new state laws and regulations are emerging, such as the Colorado AI Act which will go into effect on February 1, 2026, and California’s AB 2013, which requires generative AI developers to post information on their websites regarding the data used to train their AI systems.

•changes in interest rates and inflation;