10-K – 2026-02-17 – sofi-20251231.htm

Additionally, if we make errors in the development, validation, or implementation of any of the underwriting models or tools that we use for the loans securing our debt warehouses or included in securitization transactions or whole loan sales, or originated and sold to Loan Platform Business counterparties, such loans may experience higher delinquencies and losses, which would negatively impact our debt warehouse financing terms and future securitization, whole loan sale transactions and Loan Platform Business loan origination and sale arrangements.
If the information provided to us by applicants is incorrect or fraudulent, we may misjudge an applicant’s qualification to receive a loan or use one of our products, and our results of operations may be harmed.
Our lending and platform access decisions are based partly on information provided to us by applicants. To the extent that an applicant provides information to us in a manner that we are unable to verify, or the information provided by an applicant consists of data obtained under false pretenses by third parties, is a manufactured/synthetic identity, or is a stolen identity, our credit decisioning process may not accurately reflect the associated risk. In addition, data provided by third-party sources, including credit reporting agencies, is a significant component of our credit decisions and this data may contain inaccuracies. Inaccurate analysis of credit data that could result from false loan application information could harm our reputation, business and results of operations. Additionally, we rely on the accuracy of applicant information in approving applicants for our non-lending products, such as SoFi Money, SoFi Credit Card, SoFi Invest or SoFi Crypto accounts. If the information provided to us by these applicants is incorrect or fraudulent and we are unable to detect the inaccuracies, it increases our regulatory and fraud risk and the risk of identity theft to our members, and could harm our reputation, business and results of operations.
We use identity and fraud prevention tools to analyze data provided by external databases or automated physical identity document proofing technologies to authenticate each applicant’s identity. These fraud prevention tools, scores, and data aggregators are reliant on sustained access to reliable data sources to facilitate robust verification which have reduced effectiveness with diminished data access. From time to time in the past, however, these checks have failed and there is a risk that these checks could fail in the future and fraud, which may be significant, may occur and go undetected. For example, in the past we have identified certain fraudulent activity related to our personal loan products. While the fraudulent activity was detected and the losses were recognized in our results of operations, there can be no assurance there will not be future instances of fraud, that we will be able to detect such fraudulent activity in a timely manner, or that such future fraudulent activity will not be material. We may not be able to recoup funds underlying loans made in connection with inaccurate statements, omissions of fact or fraud, in which case our revenue, results of operations and profitability will be harmed. Fraudulent activity or significant increases in fraudulent activity could also lead to regulatory intervention, which could negatively impact our results of operations, brand and reputation, and require us to take steps to reduce fraud risk, which could increase our costs.
Internet-based loan origination processes may give rise to greater risks than paper-based processes.
We use internet-based loan processes to obtain application information and distribute certain legally required notices to applicants for, and borrowers of, loans and to obtain electronically signed loan documents in lieu of paper documents with ink signatures obtained in person. These processes may entail greater risks than paper-based loan origination processes, including regarding the sufficiency of notice for compliance with consumer protection laws, risks that borrowers may challenge the authenticity of loan documents, or the validity of the borrower’s electronic signature on loan documents, and risks that unauthorized changes are made to the electronic loan documents. If any of those factors were to cause our loans, or any of the terms of our loans, to be unenforceable against the relevant borrowers, or impair our ability to service our loans (as master servicer or servicer), the value of our loan assets would decrease significantly to us and to our whole loan purchasers, Loan Platform Business counterparties, securitization investors and warehouse lenders. In addition to increased default rates and losses on our loans, this could lead to the loss of whole loan purchasers, Loan Platform Business counterparties, and securitization investors and trigger terminations and amortizations under our debt warehouse facilities, each of which would materially adversely impact our business.
Student loans are subject to discharge in certain circumstances.
SoFi private education loans may be discharged in bankruptcy in certain situations, such as if a bankruptcy court determines that the loan is either not a qualified education loan (as defined in 225(d)(4)) of the Internal Revenue Code) or determines that not discharging the debt would impose an undue hardship on the debtor and the debtor’s dependents. Changes in law, how courts apply the law, regulations or governmental policies could increase the number of student loans subject to discharge in certain circumstances which could adversely affect our business. A private education loan may also be generally dischargeable as a result of the death or disability of the borrower.

51

SoFi Technologies, Inc.
TABLE OF CONTENTS

If a higher percentage of borrowers obtain relief under bankruptcy or other debtor relief laws in the future than is reflected in our historical experience, we could experience increased loan discharges, reduced recoveries, higher charge-offs, and increased litigation and compliance costs. In addition, adverse judicial developments could result in class action litigation, injunctions, or regulatory scrutiny relating to our servicing or collection practices with respect to such loans. Any such developments could negatively impact the value of our student loan portfolio, the performance of related securitizations, and our financial condition and results of operations. See “ Regulatory, Tax and Other Legal Risks — Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on borrower behavior, our student loan portfolios and our student loan origination volume ”.
Home equity loans expose us to heightened credit, property value and interest rate risk.
Home equity loans are subject to subordinate liens on the related property. Subordinate lien loans are structurally riskier than first lien loans because, in the event of borrower default or foreclosure, holders of first lien mortgages are entitled to repayment before subordinate lien holders. As a result, recoveries on subordinate lien loans are more sensitive to declines in residential property values and may be limited or eliminated if property values decrease or if combined loan-to-value ratios increase, In addition, changes in interest rates may adversely affect the performance and value of these loans. Rising interest rates may increase borrower payment obligations for variable-rate loans and could contribute to higher delinquency or default rates. Conversely, declining interest rates may increase prepayment activity, which could reduce expected yields. Interest rate fluctuations may also negatively impact the fair value of home equity loans held on our balance sheet. If residential property values decline, interest rates increase, or broader economic conditions weaken, we may experience higher credit losses, increased delinquencies, reduced recoveries, and impairment charges on our home equity loan portfolio, which could adversely affect our financial condition and results of operations. In addition, our ability to sell home equity loans may be limited because these loans are not categorized as conventional for GSE purchasers.
We offer personal loans, which have a limited performance history, and therefore we have only limited prepayment, loss and delinquency data with respect to such loans on which to base projections.
The performance of the personal loans we offer is significantly dependent on the ability of the credit decisioning, income validation, and scoring models we use to originate such loans, which include a variety of factors, to effectively evaluate an applicant’s credit profile and likelihood of default. Despite recession-readiness planning and stress forecasting, there is no assurance that our credit criteria can accurately predict loan performance under economic conditions such as a prolonged down-cycle or recessionary economic environment or the governmental response to periods of disruption, which may drive unexpected outcomes. If our criteria do not accurately reflect credit risk on the personal loans, greater than expected losses may result on these loans and our business, operating results, financial condition and prospects could be materially and adversely affected.
In addition, personal loans are dischargeable in a bankruptcy proceeding involving a borrower without the need for the borrower to file an adversary proceeding. The discharge of a significant amount of our personal loans could adversely affect our financial condition. Furthermore, other characteristics of personal loans may increase the risk of default or fraud and there are few restrictions on the uses that may be made of personal loans by borrowers, which may result in increased levels of credit consumption. We also originate a material portion of our personal loans through ACH deposits directly to the borrowers, which may result in a higher risk of fraud. The effect of these factors may be to reduce the amounts collected on our personal loans and adversely affect our operating results and financial condition.
We service all of the personal loans we originate and credit cards we issue, as well as other loans, and have limited servicing experience, and we rely on third-party service providers to service the student loans and home loans we originate, and to perform various other functions in connection with the origination and servicing of certain loans. If we or a third-party service provider fails to properly perform these functions, our business and our ability to service our loans may be adversely affected.
We service all of the personal loans we originate as well as certain loans originated by third parties and, in all material respects, all of the credit cards we issue, and we have limited experience with such servicing. We may begin servicing the student loans that we originate in the future. We rely on sub-servicers to service all of our student loans, our home loans that we deliver to GSEs and do not sell servicing-released and certain home equity loans, and to perform certain back-up servicing functions with respect to our personal loans. In addition, we rely on third-party service providers to perform various functions relating to our loan origination and servicing business, including fraud detection, marketing, operational functions, cloud infrastructure services, information technology, telecommunications and processing remotely created checks. While we oversee these service providers to ensure they service our loans in accordance with our agreements and regulatory requirements, we do not have control over the operations of any of the third-party service providers that we utilize. In the event that a third-party service provider for any reason fails to perform such functions, including through negligence, willful misconduct or fraud, our

52

SoFi Technologies, Inc.
TABLE OF CONTENTS

ability to process payments and perform other operational functions for which we currently rely on such third-party service providers will suffer and our business, cash flows and future prospects may be negatively impacted. Such third-party service provider failures could also result in, among other things, increased regulatory scrutiny of our third-party service provider oversight, costly investigations, required corrective action and remediation, regulatory enforcement actions, class action lawsuits, and harm to our reputation.
Any failure on our part or on the part of third parties on whom we rely to perform functions related to our servicing activities to properly service our loans or the loans originated by third parties could result in us being removed as the servicer on the loans, including loans financed by our warehouse facilities or sold into our whole loan sales channel and securitization transactions or to Loan Platform Business counterparties. If we fail to monitor our student loan sub-servicer and ensure that such sub-servicer complies with its obligations under state laws that require student loan servicers to be licensed, we may face civil claims for damages under such state laws. Because we receive revenue from such servicing activities, any such removal as the servicer or master servicer, could adversely affect our business, operating results, financial condition or prospects, as would the cost of onboarding a new servicer. Furthermore, we have agreed in our servicing agreements to service loans in accordance with the standards set forth therein and may be obligated to repurchase loans or indemnify the buyer of any such loans if we fail to meet those standards.
Additionally, if one or more key third-party service providers were to cease to exist, to become a debtor in a bankruptcy or an insolvency proceeding or to seek relief under any debtor relief laws or to terminate its relationship with us, there could be delays in our ability to process payments and perform other operational functions for which we are currently relying on such third-party service provider, and we may not be able to promptly replace such third-party service provider with a different third-party service provider that has the ability to promptly provide the same services in the same manner and on the same economic terms. As a result of any such delay or inability to replace such key third-party service provider, our ability to process payments and perform other business functions could suffer and our business, cash flows and future prospects may be negatively impacted.
We perform and manage the loan origination process for all of the home loans that we originate. If we fail to properly perform these functions, our home loans business may be adversely affected.
In April 2023, we acquired Wyndham, a mortgage lender, expanding our home loans business. In connection with the acquisition of Wyndham, we adopted loan origination technology which facilitates performing many functions in connection with the origination of home loans, including processing, underwriting, pricing, vendor management, closing, and additional functions for loan origination that we previously outsourced to third-party providers, and we now directly manage loan underwriters and loan processors which are services previously managed by third-party providers. In the event that we fail for any reason to perform or manage such functions in accordance with all applicable requirements, including through human errors, technology errors, negligence, willful misconduct or fraud, our ability to originate home loans will suffer and our business, cash flows and future prospects may be negatively impacted, and we could incur penalties or liabilities including obligations to repurchase loans from investors to whom we sold the loans. Additionally, if we fail to perform such functions or properly manage our new resources, we may be unable to complete, or be delayed in the completion of, the origination of home loans in our pipeline and to originate new home loans, and we may not be able to onboard a replacement service provider that has the ability to promptly provide the same services in the same manner and on the same economic terms.
Potential geographic concentration of our members may increase the risk of loss on the loans that we originate and negatively impact our business.
Any concentration of our members in specific geographic areas may increase the risk of loss on our loans. Certain regions of the U.S. from time to time will experience weaker economic conditions and higher unemployment and, consequently, will experience higher rates of delinquency and loss than on similar loans in other regions of the country. Moreover, a further deterioration in economic conditions or a recession, outbreaks of disease, the continued increase in extreme weather conditions and other natural events (such as hurricanes, tornadoes, floods, drought, wildfires, mudslides, earthquakes and other extreme conditions) and other factors could adversely affect the ability and willingness of borrowers in affected regions to meet their payment obligations under their loans and may consequently affect the delinquency and loss experience of such loans. In addition, we, as master servicer for all student loans and home loans and as servicer of our personal loans, have offered in the past, and may in the future offer, hardship forbearance or other relief programs in certain circumstances to affected borrowers.
Conversely, an improvement in economic conditions in one or more of the geographic areas in which we have members could result in higher prepayments of their payment obligations under their loans in such states. As a result, we and the whole loan purchasers and Loan Platform Business counterparties who hold our loans or securitization investors or warehouse lenders who hold securities backed by our loans may receive principal payments earlier than anticipated, and fewer

53

SoFi Technologies, Inc.
TABLE OF CONTENTS

interest payments than anticipated, and face certain reinvestment risks, such as the inability to acquire loans on equally attractive terms as the prepaid loans. In addition, higher prepayments than anticipated may have a negative impact on our servicing revenue which could cause our operating results and financial condition to be materially and adversely affected.
Further, the concentration of our loans in one or more geographic locations may have a disproportionate effect on us or investors in our loans or securities backed by our loans if governmental authorities in any of those areas take action against us as originator, master servicer or servicer of those loans or take action affecting our ability as master servicer or servicer to service those loans.

Funding and Liquidity Risks

If we are unable to successfully manage our assets and liabilities on the balance sheet and our funding costs, including with respect to deposit-based funding, our ability to finance additional loans and introduce new products may be negatively impacted.
We fund our operations and capital expenditures primarily through SoFi Bank deposits, warehouse funding, common equity capital, convertible debt, a corporate revolving credit facility, securitizations, and other financings, including Loan Platform Business transactions. Through SoFi Bank, we utilize deposits which generally has a lower borrowing cost of funds than warehouse financing, and we have the ability to access other funding sources, such as the FHLB and certain brokered deposit channels established by SoFi Bank. Because we rely on each of these outlets for liquidity, if we are unable to successfully manage our assets and liabilities and funding costs as described above, or if we experience a loss or reduction of these liquidity outlets, our business could be materially adversely impacted. For example, certain banks have faced operational difficulties in accessing the Federal Reserve discount window and there is no guarantee that we will not face the same or similar issues. In addition, there can be no assurance that we will be able to successfully access the securitization markets at any given time, and in the event of a sudden or unexpected shortage of funds in the banking and financial system, we cannot be sure that we will be able to maintain necessary levels of funding without incurring high funding costs, a reduction in the term of funding instruments, an increase in the amount of equity we are required to hold or the liquidation of certain assets. Furthermore, there is a risk that there will be no market at all for our loans either from whole loan buyers, the Loan Platform Business or through investments in securities backed by our loans.
We may require capital in excess of amounts we currently anticipate, and depending on market conditions and other factors, we may not be able to maintain our capital or obtain additional capital for our current operations or anticipated future growth on reasonable terms or at all. As the volume of loans that we originate, and the increased suite of products that we make available to members, increases, we may be required to expand the size of our debt warehousing facilities or seek additional sources of capital. The availability of these financing sources depends on many factors, certain of which are outside of our control. We may also experience the occurrence of events of default or breaches of financial performance or other covenants under our whole loan sale, Loan Platform Business or debt agreements, which could reduce or terminate our access to those buyers and to institutional funding.
As we think about managing our assets and liabilities on the balance sheet and our funding costs, our deposit growth may slow. If we are unable to satisfactorily manage our current sources of funding, including deposits, or, if needed, secure new or alternative methods of financing, our ability to finance additional loans and to develop and offer new products may be negatively impacted. If deposit growth slows, we may need to turn to higher cost of funds. The interest rates, advance rates and other costs of new, renewed or amended facilities may also be higher than those currently in effect. If we are unable to renew or otherwise replace these facilities or generally arrange new or alternative methods of financing on favorable terms, we may be forced to curtail our origination of loans or reduce lending or other operations, which would have a material adverse effect on our business, financial condition, operating results and cash flows.
If one or more of our warehouse facilities, on which we are highly dependent, is terminated or otherwise becomes unavailable, we may be unable to find replacement financing on favorable terms, or at all, which would have a material adverse effect on our business and financial condition.
We require a significant amount of short-term funding capacity for loans we originate. Consistent with industry practice, our existing warehouse facilities generally require periodic renewal. If any of our committed warehouse facilities are terminated or are not renewed or our uncommitted facilities are not honored, we may be unable to find replacement financing on favorable terms, or at all, and we might not be able to originate an acceptable or sustainable volume of loans, which would have a material adverse effect on our business. Additionally, as our business continues to expand, including our home loan business, we may need additional warehouse funding capacity for the loans we originate. There can be no assurance that, in the future, we will be able to obtain additional warehouse funding capacity on favorable terms, on a timely basis, or at all.

54

SoFi Technologies, Inc.
TABLE OF CONTENTS

If we fail to meet or satisfy any of the financial or other covenants included in our warehouse facilities, we would be in default under one or more of these facilities and our lenders could elect to declare all amounts outstanding under the facilities to be immediately due and payable, enforce their interests against loans pledged under such facilities and restrict our ability to make additional borrowings. Certain of these facilities also contain cross-default provisions. These restrictions may interfere with our ability to obtain financing or to engage in other business activities, which could materially and adversely affect us. There can be no assurance that we will maintain compliance with all financial and other covenants included in our warehouse facilities in the future.
In addition, our agreements with our warehouse lenders contain various concentration limits and triggers, including related to excess spread. High interest rates have in the past and may in the future place pressure on our net cost of funds for loans held at SoFi Lending Corp., which do not benefit from deposit funding through SoFi Bank, and increase the likelihood of reaching an excess spread limit. A breach of such limits or other similar terms of such agreements could result in an inability to place loans in the relevant warehouse facilities and require us to pursue other forms of financing. If we are unable to find replacement financing on favorable terms, or at all, our operations could be impacted materially.
Increases in member default rates on loans could make us and our loans less attractive to whole loan buyers, Loan Platform Business counterparties, lenders under debt warehouse facilities and investors in securitizations, which may adversely affect our access to financing and our business.
Increases in member default rates, due to deteriorating economic conditions or other factors, could make us and our loans less attractive to our existing or prospective funding sources, including whole loan buyers, Loan Platform Business counterparties, securitization investors and lenders under debt warehousing facilities. If our existing funding sources do not achieve their desired financial returns or if they suffer losses, they or prospective funding sources may increase the cost of providing future financing or refuse to provide future financing or purchase loans on terms acceptable to us or at all.
Our securitizations are nonrecourse to the Company and are collateralized by the pool of our loans pledged to the relevant securitization issuer. If the loans securing our securitizations fail to perform as expected, rating agencies have in the past and may in the future place our bonds on watch or change their ratings on (or their ratings methodology for) the bonds issued by our securitization trusts. Our loans performance and any actions taken by the rating agencies could result in the lenders under our warehouse facilities, the whole loan purchasers who purchase our loans, the investors in our securitizations who purchase securities backed by our loans, or future lenders, whole loan purchasers, Loan Platform Business counterparties or securitization investors in similar arrangements, increasing the cost of providing future financing or refusing to provide future financing or purchase loans on terms acceptable to us or at all.
While this risk may be partially mitigated by our ability to hold loans on our balance sheet and to quickly modify the origination volume under the Loan Platform Business, in sufficient volume, high member default rates would negatively impact our financial condition. Consequently, if we were to be unable to arrange new or alternative methods of financing on favorable terms, we may have to curtail or cease our origination of loans, which could have a material adverse effect on our business, financial condition, operating results and cash flows.
We make representations and warranties in connection with the transfer of loans to whole loan purchasers, Loan Platform Business counterparties, government-sponsored enterprises, and our debt warehouse lenders and securitization trusts. If such representations and warranties are not correct, we could be required to repurchase loans or indemnify the purchaser, which could have an adverse effect on our ability to operate and fund our business.
We sell and finance the loans we originate to and with third parties, including, with respect to home loans, counterparties like GSEs, and we make certain representations and warranties to those third parties in connection with the transfer of loans described below. In the ordinary course of business, we are exposed to liability under these representations and warranties made to purchasers of loans. Such representations and warranties typically include, among other things, that the loans were originated and serviced in compliance with the law and with our credit risk origination policy and servicing guidelines, and, in connection with transfers to GSEs, that the loans were originated in compliance with the guidelines of the relevant GSE, and that, to the best of our knowledge, each loan was originated by us without any fraud or misrepresentation on our part or on the part of the borrower or any other person. In addition, purchasers require loans to meet strict underwriting and loan term criteria in order to be eligible for purchase. If those representations and warranties are breached as to a given loan, or if a certain loan we sell does not meet the relevant eligibility criteria, we will be obligated to repurchase the loan, typically at a purchase price equal to the then-outstanding principal balance of such loan, plus accrued interest and any premium. We may also be required to indemnify the purchaser for losses resulting from the breach of representations and warranties. With regard to home loans insured by the Federal Housing Administration or the VA, and to the extent that any of our home loans do not comply with Federal Housing Administration or VA guidelines, we could also face claims under the False Claims Act. In connection with our whole loan sales and certain Loan Platform Business sales, we also typically covenant to repurchase any

55

SoFi Technologies, Inc.
TABLE OF CONTENTS

loan that enters delinquent status within the first thirty to sixty days following origination of the loan. Any significant increase in our obligation to repurchase loans or indemnify purchasers of loans could have a significant adverse impact on our cash flows, even if they are reimbursable, and could also have a detrimental effect on our business and financial condition. If any such repurchase event occurs on a large scale, we may not have sufficient funds to meet our repurchase obligations, which would result in a default under the underlying agreements. Moreover, we may not be able to resell or refinance loans repurchased due to a breach of a representation or warranty or we may be forced to sell such loans below par. Any such event could have an adverse impact on our business, operating results, financial condition and prospects. In addition, in the acquisition of Wyndham, we also acquired Wyndham's liability to its loan investors and loan insurers for mortgage loans originated by Wyndham, including repurchase obligations that might not be contingent upon the investor proving an error by Wyndham.
In addition to loan level representations and warranties, our agreements with the lenders and investors on our securitizations, debt warehouse facilities and corporate revolving debt contain a number of corporate financial covenants and early payment triggers and performance covenants. These facilities, together with deposits, are the primary funding sources available to support the maintenance and growth of our business and our liquidity would be materially adversely affected by our inability to comply with the various covenants and other specified requirements set forth in our agreements with our lenders and investors, which could result in the early amortization, default and/or acceleration of our existing facilities. Such covenants and requirements include financial covenants, portfolio performance covenants and other events. For a description of these covenants, requirements and events, see “ Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources ”.
During an early amortization period or occurrence of a termination event or an event of default, principal collections from the loans in our warehouse facilities would be applied to repay principal under such facilities rather than being available to fund newly originated loans. During the occurrence of a termination event or an event of default under any of our facilities, the applicable lenders could accelerate the related debt and such lenders’ commitments to extend further credit under the related facility, if any, would terminate. If we were unable to repay the amounts due and payable under such facilities and securitizations, the applicable lenders and noteholders could seek remedies, including against the collateral pledged under such facilities and by the securitization trust. An acceleration of the debt under certain facilities could also lead to a default under other facilities and, in certain instances, our hedging arrangements, due to cross-default and cross-acceleration provisions.
An early amortization event or event of default would negatively impact our liquidity, including our ability to originate new loans, and require us to rely on alternative funding sources, which might increase our funding costs or which might not be available when needed. If we were unable to arrange new or alternative methods of financing on favorable terms, we might have to hold loans on balance sheet in an amount that may negatively impact our financial condition, or curtail or cease the origination of loans, which could impair our growth, and, in each case, have a material adverse effect on our business, financial condition, operating results and cash flows, which in turn could have a material adverse effect on our ability to meet our obligations under our facilities.
We require substantial capital and, in the future, may require additional capital, to pursue our business objectives and achieve recurring profitability. If adequate capital is not available to us or is unavailable on favorable terms, including due to the cost and availability of funding in the capital markets, our business, operating results and financial condition may be harmed.
Since our founding and as recently as 2025, we have raised substantial equity and debt financing to support the growth of our business. We may require additional capital to pursue our business objectives and growth strategy and respond to business opportunities, challenges or unforeseen circumstances, including supporting our lending operations, increasing our marketing expenditures to attract new members and technology platform clients and improve our brand awareness, developing our products, introducing new services, further expanding internationally in existing or new countries or further improving existing offerings and services, enhancing our operating infrastructure and potentially acquiring complementary businesses and technologies, and complying with the increased regulatory requirements for bank holding companies and banks. Accordingly, on a regular basis we need, or we may need, to engage in additional debt or equity financings to secure additional funds. However, additional funds may not be available when we need them, in amounts we need, or permitted to be applied to specific use cases, on terms that are acceptable to us or at all. Volatility in the credit markets in general or in the market for personal, student and home loans and credit cards in particular may also have an adverse effect on our ability to obtain debt financing. Although our borrowing costs have trended lower following the acquisition of a national bank charter, the cost of our borrowing could increase due to market volatility, interest rates that, while decreasing, remain higher than those in the recent past, changes in the risk premiums required by lenders or the unavailability of traditional sources of debt capital. Volatility or depressed valuations or trading prices in the equity markets may similarly adversely affect our ability to obtain equity financing. Furthermore, if we raise additional funds through further issuances of equity or convertible debt securities, our existing

56

SoFi Technologies, Inc.
TABLE OF CONTENTS

stockholders could suffer significant dilution and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.
We are required to serve as a source of financial strength for SoFi Bank, which is subject to minimum capital requirements imposed by federal regulators, which means that we may be required to provide capital or liquidity support to SoFi Bank, even at times when we may not have the resources to provide such support. In addition, maintaining adequate liquidity is crucial to our securities brokerage, including key functions such as transaction settlement, custody requirements and margin lending. Our broker-dealer subsidiary, SoFi Securities, is subject to Rule 15c3-1 under the Exchange Act, which specifies minimum capital requirements intended to ensure the general financial soundness and liquidity of broker-dealers, and SoFi Securities is subject to Rule 15c3-3 under the Exchange Act, which requires broker-dealers to maintain certain liquidity reserves. We meet our liquidity needs primarily from working capital, deposits and cash generated by member activity, as well as from external debt and equity financing. Increases in the number of members, fluctuations in member cash or deposit balances, as well as market conditions or changes in regulatory treatment of member deposits, may affect our ability to meet our liquidity needs.
A reduction in our liquidity position could reduce our members’ confidence in us, which could result in the withdrawal of member assets, including deposits held at SoFi Bank, and loss of members, or could cause us to fail to satisfy minimum capital requirements for SoFi Bank, or broker-dealer or other regulatory capital guidelines, which may result in immediate suspension of banking and other securities activities, regulatory prohibitions against certain business practices, increased regulatory inquiries and reporting requirements, increased costs, fines, penalties or other sanctions, by the Federal Reserve, the OCC, the SEC, FINRA or other SROs or state regulators, and could ultimately lead to the liquidation of SoFi Bank or our broker-dealer or other regulated entities. Factors which may adversely affect our liquidity position include temporary liquidity demands due to timing differences between brokerage transaction settlements and the availability of segregated cash balances, fluctuations in cash held in member accounts, a significant increase in our margin lending activities, increased regulatory capital requirements, changes in regulatory guidance or interpretations, or Federal Housing Administration or VA guidelines, other regulatory changes or a loss of market or member confidence resulting in unanticipated withdrawals of member assets. We expect that we will continue to use our available cash to fund our lending activities and help scale our Financial Services segment. To supplement our cash resources, we may seek to enter into additional securitizations and whole loan sale agreements and Loan Platform Business origination and sale agreements or increase the size of existing debt warehousing facilities, increase the size of, or replace, our revolving credit facility, continue to grow deposits and pursue other potential options. In addition, a reduction in our liquidity position could impair our technology platform clients’ confidence in us and our platform as a service products and services, many of which require capital investments and ongoing platform maintenance by us, which could result in decisions by our technology platform clients to terminate or not renew their existing contracts or to not add new products to their account.
If we are unable to adequately maintain our cash resources, we may delay non-essential capital expenditures, implement cost cutting procedures, delay or reduce future hiring, discontinue the pursuit of our strategic objectives and growth strategies or reduce our rate of future originations compared to the current level. There can be no assurance that we can obtain sufficient sources of external capital to support the growth of our business. Delays in doing so or failure to do so may require us to reduce loan originations or reduce our operations, which would harm our ability to pursue our business objectives as well as harm our business, operating results and financial condition.
We are unable to finance all of the receivables that we originate or other assets that we hold, and that illiquidity could result in a negative impact on our financial condition.
We have the option of pursuing a gain-on-sale origination model, the success of which is tied to our ability to finance the assets that we originate. Certain of our assets, however, are ineligible for sale to a whole loan buyer, Loan Platform Business counterparty or securitization trust, or are ineligible for, or are subject to a lower advance rate under, warehouse funding, each of which has specific eligibility criteria for receivables it purchases or holds as collateral. Ineligible receivables include, among others, those in default or that are delinquent, receivables with defects in their origination or servicing, including fraud, or receivables generated under origination guidelines and credit policies that are no longer in effect. In addition, many of our warehouse funding sources and certain of our Loan Platform Business arrangements contain excess concentration limits for loans in forbearance or with specific loan level characteristics such as time-to-maturity or loan type. Once these limits have been exceeded, the advance rate applied to those receivables becomes less advantageous to us or, under such Loan Platform Business arrangements, we are prohibited from selling such loans to the relevant counterparty. If we are unable to sell or reasonably fund these receivables, we are required to hold them on our consolidated balance sheet which, in sufficient volume, negatively impacts our financial condition.

57

SoFi Technologies, Inc.
TABLE OF CONTENTS

In addition to the receivables described above, we also hold on our consolidated balance sheet certain risk retention assets with respect to which we have a reduced ability to receive financing. These risk retention assets include residuals from our securitization trusts that are either ineligible for transfer or are subject to EU regulations. The illiquidity of these positions may negatively impact our financial condition.
Our checking and savings product is expected to continue to provide us with an important source of cost-efficient funding and any failure to scale the product due to our limited experience or a competitive marketplace could have a negative impact on our business, operating results and financial condition.
We expect that checking and savings, a deposit account product, will continue to provide us with an important source of deposits to use for cost-effective funding of loan originations and other activities. However, revenue growth for checking and savings is dependent on increasing the volume of members who open an account and on growing balances in those accounts. Although our checking and savings account product has grown since its introduction in the first quarter of 2022, there is no guarantee that account openings and the amount on deposit in those accounts will continue to grow. In addition, although we have invested in a number of initiatives to attract new checking and savings account holders and capture a greater share of our members’ savings, including offering a competitive annual percentage yield on deposits and offering SoFi Plus membership benefits to certain deposit holders, there can be no assurance that these investments to acquire and retain members, provide differentiated features and services and spur usage of our deposit account product will be effective or cost effective. There are also no assurances that we will be able to maintain a competitive annual percentage yield on deposits, and members can easily transfer checking and savings account balances to our competitors. Further, developing our service offerings and marketing the checking and savings product in additional customer acquisition channels could have higher costs than anticipated or be less effective than anticipated, and could adversely impact our results or dilute our brand. Finally, our checking and savings product faces competition from similar products offered by our competitors which may offer more attractive features, including a higher interest rate on deposits, which may impact the success of the product. In the event we are unable to sufficiently grow the checking and savings product, we may be required to find alternative, higher-cost funding for our lending and other activities, or we might not be able to originate an acceptable or sustainable volume of loans, either of which could have a negative impact on our business, operating results and financial condition. See “ Market and Interest Rate Risks — Fluctuations in interest rates could negatively affect the demand for our checking and savings product ”.
Any failure to accurately capture credit risk or to execute our funding strategy for SoFi Credit Card could have a negative impact on our business, operating results and financial condition.
In October 2024, we expanded our credit card program by launching two new credit cards: SoFi Everyday Cash Rewards and SoFi Essential, and in December 2025, we launched the SoFi Smart Card, a charge card secured by the member’s SoFi Checking and Savings Account. The performance of these new credit cards and the existing SoFi Unlimited 2% Credit Card product is significantly dependent on the ability of the credit and fraud decisioning and scoring models we use to originate the product, which includes a variety of factors, to effectively prevent fraud, evaluate an applicant’s credit profile and likelihood of default. Despite establishing a defined risk appetite and leveraging third-party stress testing of product loss forecasts, there is no assurance that our credit criteria can accurately predict repayment and loss profiles. If our criteria do not accurately prevent fraud or reflect credit risk on the SoFi Credit Card products, greater than expected losses may result and our business, operating results, financial condition and prospects could be materially and adversely affected.
The success of the SoFi Credit Card program is also dependent on our ability to grow revenue which is, in turn, dependent on increasing the volume of members who open an account and on growing loan balances on those accounts. Over time we will continue to invest in a number of new product initiatives to attract new SoFi Credit Card members and capture a greater share of our members’ total spending and borrowings, including through rewards programs. However, the operation of our rewards program for certain of the SoFi Credit Card products could have a negative impact on the revenue for our Credit Card program. In addition, revenue growth for SoFi Credit Card may also be adversely affected by proposed restrictions on credit card interest. On January 9, 2026, President Trump announced his intent to fulfill a campaign promise to cap credit card interest at 10.00% for one year, to be effective on January 20, 2026, though no formal executive order or proposed rule was issued at that time. Although the proposed cap on credit card interest may provide opportunities in other segments of our business, if enforced, it would likely adversely impact the SoFi Credit Card program. The proposal currently faces an unclear enforcement path and significant industry opposition, with many questioning whether it would actually reduce credit availability for consumers.
While we have generally seen increases in revenue from SoFi Credit Card, there can be no assurance that our investments in SoFi Credit Card to acquire members, provide differentiated features and services and spur usage of our cards will continue to be effective, and developing our service offerings and forming new partnerships could have higher costs than anticipated, and could adversely impact our results or dilute our brand.

58

SoFi Technologies, Inc.
TABLE OF CONTENTS

Furthermore, the success of the SoFi Credit Card products depends on our ability to execute on our funding strategy for the resulting credit card receivables. We may establish a credit card receivable securitization program in the future. There is no guarantee, however, that we will be successful in establishing a securitization program for these assets. In the event we are unable to finance our credit card receivables, we may be required to hold those assets on our consolidated balance sheet or sell them for a loss, either of which could have a negative impact on our business, operating results and financial condition.

Regulatory, Tax and Other Legal Risks

As a bank holding company, we are subject to extensive supervision and regulation, and changes in laws and regulations applicable to bank holding companies could limit or restrict our activities and could have a material adverse effect on our operations.
As a bank holding company, we are subject to regulation, supervision and examination by the Federal Reserve, and SoFi Bank is subject to regulation, supervision and examination by the OCC and the FDIC, as well as regulations issued by the CFPB. Federal laws and regulations govern numerous matters affecting us, including changes in the ownership or control of banks and bank holding companies, maintenance of adequate capital and the financial condition of a financial institution, permissible types, amounts and terms of extensions of credit and investments, permissible nonbanking activities, the level of reserves against deposits and restrictions on dividend payments. The OCC possesses the power to issue cease and desist orders to prevent or remedy unsafe or unsound practices or violations of law by banks subject to their regulation, and the Federal Reserve possesses similar powers with respect to bank holding companies. In general, the bank supervisory framework is intended to protect insured depositors and the safety, soundness and stability of the U.S. financial system and not shareholders in depository institutions or their holding companies.
In connection with applying for approval to become a bank holding company, we developed a financial and bank capitalization plan and enhanced our governance, compliance, controls and management infrastructure and capabilities in order to ensure compliance with all applicable regulations, which required, and will continue to require, substantial time, monetary and human resource commitments. If any new regulations or interpretations of existing regulations to which we are subject impose requirements on us that are impractical or that we cannot satisfy, our financial performance, and our stock price, may be adversely affected.
Federal regulations establish minimum capital requirements for insured depository institutions, including minimum risk-based capital and leverage ratios, and define “capital” for calculating these ratios. The minimum capital requirements are: (i) a common equity Tier 1 capital ratio of 4.5%; (ii) a Tier 1 to risk-based assets capital ratio of 6%; (iii) a total capital ratio of 8%; and (iv) a Tier 1 leverage ratio of 4%. The regulations also establish a “capital conservation buffer” of 2.5% of common equity Tier 1 capital. An institution will be subject to limitations on paying dividends, engaging in share repurchases and paying discretionary bonuses if its capital level falls below the capital conservation buffer amount. The federal banking regulators could also require the Company and/or SoFi Bank, as applicable, to hold capital that exceeds minimum capital requirements for insured depository institutions. The application of these capital requirements could, among other things, require us to maintain higher capital resulting in lower returns on equity, and we may be required to obtain additional capital, or face regulatory actions if we are unable, to comply with such requirements.
We are also subject to the requirements in Sections 23A and 23B of the Federal Reserve Act and the Federal Reserve’s implementing Regulation W, which regulate loans, extensions of credit, purchases of assets, and certain other transactions between an insured depository institution (such as SoFi Bank) and its affiliates. The statute and regulation require us to impose certain quantitative limits, collateral requirements and other restrictions on “covered transactions” between SoFi Bank and its affiliates and require all transactions be on “market terms” and conditions consistent with safe and sound banking practices. For example, Galileo’s provision of technology services to SoFi Bank is subject to Regulation W, including the requirement that the arrangement is on market terms. If we fail to comply with the requirements of Sections 23A and 23B of the Federal Reserve Act and Regulation W for any reason, we may be subject to significant penalties, including substantial civil fines, mandatory consent orders, restrictions on SoFi Bank’s activities and, potentially, be required to divest subsidiaries.
The laws, rules, regulations, and supervisory guidance and policies applicable to us are subject to regular modification and change, including increased regulation as a result of the turmoil in the banking industry. These changes could adversely and materially impact us. For example, the Dodd-Frank Act and other federal banking laws subject companies with $10 billion or more of consolidated assets to additional regulatory requirements. Section 1075 of the Dodd-Frank Act, which is commonly known as the “Durbin Amendment”, amended the Electronic Fund Transfer Act to restrict the amount of interchange fees that may be charged and prohibit network exclusivity for debit card transactions. SoFi Bank is required to comply with the restrictions on interchange fees that went into effect on July 1, 2023, which may negatively impact future interchange fees we

59

SoFi Technologies, Inc.
TABLE OF CONTENTS

collect. In addition, in November 2023, the Federal Reserve proposed changes to the regulations implementing the Electronic Fund Transfer Act that would further restrict the amount of interchange fees that may be charged and require biennial reviews of those fees.
Furthermore, guidance from regulators of the Company and SoFi Bank can subject its non-bank affiliates to increased governance. For example, the OCC’s guidance on retail non-deposit investment products, or RNDIPs, applies to referral arrangements that SoFi Bank may have with an affiliate, including SoFi Securities. This guidance, which was further updated in June 2024 to align with the SEC’s Regulation BI, requires that banks implement and maintain effective oversight and monitoring of relevant RNDIP arrangements to ensure that, among other things, sales transactions and recommendations to retail investors comply with SEC regulations. In addition, our platform as a service activities engaged in through our Technology Platform, are subject to increased regulatory governance by the Federal Reserve, including related to anti-money laundering and sanctions compliance obligations, because Galileo and Technisys are non-bank subsidiaries of a bank holding company. Changes in laws, rules, regulations and supervisory guidance and policies could, among other things, subject us to additional costs, including costs of compliance; limit the types of financial services and products we may offer; and/or increase the ability of non-banks to offer competing financial services and products. Failure to comply with laws, regulations, policies, or supervisory guidance could result in enforcement and other legal actions by federal and state authorities, including criminal and civil penalties, the loss of FDIC insurance, revocation of a banking charter or registration as a broker-dealer and investment adviser, other sanctions by regulatory agencies, civil money penalties, and/or reputational damage, which could have a material adverse effect on our business, financial condition, and results of operations.
Finally, we have recently introduced and intend to continue to explore other products for SoFi Bank over time, including digital assets and blockchain products, and expect to expand SoFi Bank’s product offering internationally. Certain of those products and international activities may require, or be deemed to require, additional data, procedures, partnerships, regulatory approvals, or capabilities that we have not yet obtained or developed. Should we fail to expand and evolve SoFi Bank products and activities in a successful manner, or should these new products, or new regulations or interpretations of existing regulations, impose requirements on us that are cumbersome or that we cannot satisfy, our business may be materially and adversely affected.
The U.S. Congress, the U.S. Presidential administration, or any new administration may make substantial changes to fiscal, tax, and other federal policies that may adversely affect our business.
The current U.S. Presidential administration has made and continues to call for significant changes to U.S. trade, healthcare, immigration and government regulatory policy and has implemented policy changes at a rapid pace. Changes to U.S. policy implemented by the U.S. Congress, the current U.S. Presidential administration or any new administration have impacted among other things, the U.S. and global economy, international trade relations, unemployment, immigration, healthcare, taxation, the U.S. regulatory environment, inflation, defense and other areas. Although we cannot predict the impact, if any, of these changes to our business, they could adversely affect our business. Until we know what policy changes are made, whether those policy changes are challenged and subsequently upheld by the court system and how those changes impact our business and the business of our competitors over the long term, we will not know if, overall, we will benefit from them or be negatively affected by them.
Failure to comply with applicable laws, regulations or commitments, or to satisfy our regulators’ supervisory expectations, could subject us to, among other things, supervisory or enforcement action, which could adversely affect our business, financial condition and results of operations.
If we do not comply with applicable laws, regulations or commitments, if we are deemed to have engaged in unsafe or unsound conduct, or if we do not satisfy our regulators’ supervisory expectations, then we may be subject to increased scrutiny, supervisory criticism, governmental or private litigation and/or a wide range of potential monetary penalties or consequences, enforcement actions, criminal liability and/or reputational harm. Such actions could be public or of a confidential nature, and arise even if we are acting in good faith or operating under a reasonable interpretation of the law and could include, for example, monetary penalties, payment of damages or other monetary relief, restitution or disgorgement of profits, directives to take remedial action or to cease or modify practices, restrictions on growth or expansionary proposals, denial or refusal to accept applications, removal of officers or directors, prohibition on dividends or capital distributions, increases in capital or liquidity requirements and/or termination of SoFi Bank’s deposit insurance. Additionally, compliance with applicable laws, regulations and commitments requires significant investment of management attention and resources. Any failure to comply with applicable laws, regulations or commitments could have an adverse effect on our business, financial condition and results of operations.

60

SoFi Technologies, Inc.
TABLE OF CONTENTS

An inability to accept or maintain deposits due to regulatory constraints could materially adversely affect our liquidity position and our ability to fund our business.
SoFi Bank accepts deposits and uses the proceeds as a source of funding, with our direct retail deposits becoming a larger proportion of our funding over time. Our deposit product has several features designed to attract consumers, including competitive interest rates, the availability of the SoFi Insured Deposit Program, whereby funds (up to $3 million) are deposited into deposit accounts at banks which are insured by the FDIC up to the applicable limits, and SoFi Plus rewards opportunities. Despite these features, we continue to face strong competition with regard to deposits, and our ability to accept and maintain deposit funding and offer competitive interest rates on deposits is dependent on, among other things, SoFi Bank’s capital levels. The FDIA’s brokered deposit provisions and related FDIC rules in certain circumstances prohibit banks from accepting or renewing brokered deposits and apply other restrictions, such as a cap on interest rates that can be paid. For example, while SoFi Bank met the definition of “well-capitalized” as of December 31, 2025 and currently has no restrictions regarding acceptance of brokered deposits or setting of interest rates, there can be no assurance that we will continue to meet this definition. Additionally, our regulators can adjust applicable capital requirements at any time and have authority to place limitations on our deposit business. An inability to attract or maintain deposits in the future due to regulatory constraints could materially adversely affect our ability to fund our business.
Legislative and regulatory policies and related actions have had and could in the future have a material adverse effect on borrower behavior, our student loan portfolios and our student loan origination volume.
Recent and evolving changes to federal student loan laws, regulations, and Department of Education policies—including material changes adopted in 2025 and scheduled to take effect in 2026—could adversely affect our student loan-related businesses (including origination, refinancing, servicing, collections, and ancillary products) by changing borrower repayment behavior, demand for refinanced student loan and other student loan credit products, and broader economic trends, and could materially impact our financial condition and results of operations. In particular, recent developments include (i) significant legislative changes enacted in 2025 that are expected to restructure aspects of federal borrowing and repayment beginning July 1, 2026, including the introduction of a new income-driven repayment option (commonly described as a “Repayment Assistance Plan”), changes to borrowing limits and program design, and the elimination of the GRAD Plus program, (ii) continued policy and litigation-driven disruption associated with the Biden administration SAVE repayment plan, including Department of Education actions tied to court injunctions and subsequent program transitions, and (iii) changes to federal default and involuntary collection practices, including a recently announced pause on wage garnishment and tax refund offsets for certain borrowers in default while the Department of Education implements repayment system changes. The Department of Education has also finalized additional program regulations with effective dates in 2026 (including regulations affecting Public Service Loan Forgiveness).
These developments—and any further changes adopted by Congress, the Department of Education, the CFPB, or the courts—may increase uncertainty and volatility in borrower behavior and the economics of both federal and private student loan products. For example, modifications to repayment options, forgiveness eligibility, and default collection policies may change borrowers’ incentives to refinance federal loans into private loans; reduce demand for our products; increase prepayment or extension risk; and shift delinquency, default, and cure patterns in ways that are difficult to predict. Similarly, although it may appear that the elimination of the GRAD Plus federal loan program will increase demand for our private student loan product, there is no guarantee that this will occur. In addition, program changes may increase operational complexity (including system updates, borrower communications, and training), elevate complaint volume and regulatory scrutiny, and heighten litigation and enforcement risk—particularly if borrowers experience payment shocks, confusion regarding plan transitions, or disputes over eligibility and servicing practices. Because the scope, implementation timing, and interpretation of these changes remain uncertain—and could be further modified through additional rulemaking, sub-regulatory guidance, appropriations actions, or court decisions—we may be required to make rapid changes to products, underwriting, servicing, loss mitigation, and compliance processes, and we may incur increased costs to do so. Any failure to timely and effectively adapt, or any adverse effect on borrower performance, demand, or competitive dynamics, could materially and adversely affect our business, reputation, results of operations, and financial condition.
Furthermore, these policy shifts may influence the overall financial well-being and creditworthiness of individuals carrying student debt. For example, the replacement of multiple income-driven repayment options with narrower alternatives, changes to forgiveness eligibility, and increased default collection activity could raise monthly payment burdens or accelerate delinquency for certain borrowers, potentially reducing consumer spending, increasing financial stress, or altering borrowing patterns. In addition, uncertainty around future student loan policy—such as ongoing litigation, shifting program eligibility criteria, or potential future reforms—may affect borrower confidence and decision-making. These conditions could lead to

61

SoFi Technologies, Inc.
TABLE OF CONTENTS

variations in demand for consumer financial products, increased credit risk, or changes in macroeconomic consumption patterns that negatively impact our business operations, loan portfolios, liquidity, or financial results.
Finally, although repayment requirements for federal student loans have resumed since October 2023, following multiple extensions of the CARES Act’s pause on student loan repayments, which began in March 2020, and despite current uncertainty as to the future of the Department of Education itself and to prior policy proposals related to student debt relief and federal student loan programs, policymakers continue to face political pressure to reduce or cancel student loans or accrued interest at a significant scale. If this political pressure results in the revival of any student debt relief policy proposals, it could reduce demand for our student loan refinancing product and have a negative impact on our loan origination volume and revenue. If in the future, student loans were forgiven or canceled in any meaningful scale, or if federal loan borrowers were permitted to refinance at lower interest rates, our student loan refinancing business within our Lending segment would be materially and adversely affected and our profitability, results of operations, financial condition, cash flows or future business prospects could be materially and adversely affected as a result. In addition, proposals to make student loans dischargeable in bankruptcy or similar proposals could make whole loan purchasers less likely to purchase our student loans, securitization investors less likely to purchase securities backed by our student loans or warehouse lenders less likely to lend against our student loans at attractive advance rates. As a result of any material adverse effect to our Lending segment, our overall profitability, results of operations, financial condition, cash flows or future business prospects may be adversely affected.
Although we continue to evaluate the ultimate impact of local, state and federal legislation, regulation and politics, guidance and actions, future legislative, regulatory and executive actions, and the ongoing impact of our own forbearance measures on our financial results, business operations and strategies, there is no guarantee that our estimates will be accurate or that any actions we take based on such estimates will be successful. Furthermore, we believe that the cost of responding to, and complying with, evolving laws and regulations, as well as any guidance from enforcement actions, will continue to increase, as will the risk of penalties and fines from any enforcement actions that may be imposed on our businesses. Our profitability, results of operations, financial condition, cash flows or future business prospects could be materially and adversely affected as a result.
If we fail to comply with federal and state consumer protection laws, rules, regulations and guidance, our business could be adversely affected.
We must comply with federal, state and local consumer protection laws including, among others, the federal and state UDAAP laws, the Federal Trade Commission Act, the Truth in Lending Act, the CRA, the Real Estate Settlement Procedures Act, the ECOA, the FHA, the HMDA, the Secure and Fair Enforcement for Mortgage Licensing Act, FCRA, state law versions of the Fair Debt Collection Practices Act, the Servicemembers Civil Relief Act, the Military Lending Act, the Electronic Fund Transfer Act, the GLBA, the CARES Act and the Dodd-Frank Act. We must also comply with laws on advertising, as well as privacy laws, including the TCPA, the Telemarketing Sales Rule, the CAN-SPAM Act, the Personal Information Protection and Electronic Documents Act, applicable laws and regulations of Hong Kong including the Personal Data (Privacy) Ordinance and the Personal Data (Privacy) (Amendment) Ordinance 2012 and the CCPA and other state privacy laws. Privacy and data security concerns, data collection and transfer restrictions, contractual obligations and U.S. laws and regulations related to data privacy, security and protection could materially and adversely affect our business, financial condition and results of operations. Compliance with applicable laws is costly, and our failure to comply with applicable federal, state and local laws could lead to:
• loss of our licenses and approvals to engage in our lending and servicing businesses;
• damage to our reputation in the industry;
• governmental investigations and enforcement actions;
• administrative fines and penalties and litigation;
• civil and criminal liability, including class action lawsuits;
• inability to enforce loan agreements;
• diminished ability to sell loans that we originate or purchase, requirements to sell such loans at a discount compared to other loans or repurchase or address indemnification claims from purchasers of such loans;
• loss or restriction of warehouse facilities to fund loans;
• loss of Loan Platform Business counterparties and whole loan purchasers to purchase loans;
• inability to raise capital; and
• inability to execute on our business strategy, including our growth plans.

62

SoFi Technologies, Inc.
TABLE OF CONTENTS

For example, we rely on a variety of direct marketing techniques, including email and telephone marketing. These activities are regulated by legislation such as the CAN-SPAM Act and TCPA. Any failure by us to comply fully with the CAN-SPAM Act and/or TCPA may leave us subject to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act and TCPA, and various United States state laws, or new federal laws regarding marketing and solicitation or international data protection laws that govern these activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.
The CRA, to which SoFi Bank is subject, presents another useful example of how a failure to comply with applicable laws could hamper our growth. On January 1, 2023, SoFi Bank began operating under a five-year CRA strategic plan which includes measurable goals relating to: (i) CD Lending and CD Investments, (ii) CD Contributions, (iii) CD Services, (iv) Small Business Lending, and (v) Retail Services and Products. The OCC’s assessment of our compliance with the CRA is taken into account when evaluating any application we submit for, among other things, a merger or the acquisition of another financial institution. Our failure to satisfy our CRA obligations could, at a minimum, result in the denial of such applications and limit our growth.
In addition, SoFi Bank and its affiliates are subject to supervision and regulation by the CFPB, an agency which oversees compliance with and enforces federal consumer financial protection laws, with respect to federal consumer protection laws, including laws relating to fair lending and the prohibition of UDAAP in connection with the offer, sale or provision of consumer financial products and services. As part of its regulatory oversight, the CFPB may seek a range of remedies, including rescission of contracts, refund of money, return of real property, restitution, disgorgement of profits or other compensation for unjust enrichment, damages, public notification of the violation and “conduct” restrictions (i.e., future limits on the target’s activities or functions). Under the Biden administration, the CFPB pursued an aggressive enforcement policy with respect to a range of regulatory compliance matters. For example, on January 6, 2022, the CFPB announced an initiative to scrutinize so-called consumer “junk fees.” Since then, the CFPB has issued guidance to banks on how to avoid charging unlawful overdraft and depositor fees, confirmed their policy against “pay to pay” fees or charging any fees not expressly authorized and properly disclosed in a consumer agreement, issued a final rule limiting credit card penalty fees, which was stayed pending ongoing litigation, and launched an inquiry into junk fees in mortgage closing costs. The CFPB has also identified additional unfair, deceptive, and abusive acts or practices that could violate the CFPA, including certain billing and collection practices after bankruptcy discharges of certain student loan debt, taking unreasonable advantage of a consumer’s reasonable reliance on an operator or lead generator to act in the consumer’s interests, and including unclear or unenforceable terms and conditions in consumer contracts or fine print. Notably, the CFPB rescinded guidance on substantially all of these topics in May 2025. However, the positions taken in the now-rescinded guidance still represent potentially valid interpretations of existing law, which may be enforced or pursued by the CFPB or other federal or state regulators, or private plaintiffs, now or in the future. The CFPB previously focused on student borrower harms from servicing failures, program disruptions, college banking and credit card agreements, and a variety of illegal practices and has been active in litigation against student loan servicers and others, including Climb Credit and its largest shareholder 1/0, Ejudicate, Navient, Prehired, the National Collegiate Student Loan Trusts and Pennsylvania Higher Education Assistance Agency, Western Benefits Group, Student Loan Pro and its owner, Judith Noh, and Performant Recovery, Inc. for CFPA and other violations. Increased enforcement or rules from the CFPB could increase our legal and financial compliance costs, require us to evaluate or amend certain activities or products in light of evolving compliance standards, make certain activities more difficult, time-consuming and costly, and increase demand on our systems and resources.
Furthermore, we hold lending licenses or similar authorizations in multiple states, each of which has the authority to supervise and examine our activities. As a licensed consumer lender, mortgage lender, loan broker, collection agency, and loan servicer in certain states, we are subject to examinations by state agencies in those states. Similarly, we are subject to licensure requirements and regulations as an education loan servicer in multiple states. An administrative proceeding, litigation, investigation or regulatory proceeding relating to allegations or findings of the violation of such laws by us, any sub-servicer we engage, or our collection agents, could impair our ability to service and collect on our loans or could result in requirements that we pay damages, fines or penalties and/or cancel the balance or other amounts owing under one or more of our loans. There is no assurance that allegations of violations of the provisions of applicable federal or state consumer protection laws will not be asserted against us, any sub-servicers or collection agents we engage or other prior owners of our loans in the future. To the extent it is determined that any of our loans were not originated in accordance with all applicable laws, we may be obligated to repurchase such loan from a whole loan buyer, Loan Platform Business counterparty, securitization trust or warehouse facility.
While we have developed and monitor policies and procedures designed to assist in compliance with laws and regulations, no assurance can be given that our compliance policies and procedures will be effective and that we will not be subject to fines and penalties. For example, in 2019, we were subject to a consent order from the FTC (the “FTC Consent Order”), which resolved allegations that we misrepresented how much money student loan borrowers have saved or would save

63

SoFi Technologies, Inc.
TABLE OF CONTENTS

from financing their loans with us, in violation of the Federal Trade Commission Act. Under the FTC Consent Order, we are prohibited from misrepresenting to consumers how much money they would save by using our products, unless the claims are backed up by reliable evidence. Ambiguities in applicable statutes and regulations may leave uncertainty with respect to permitted or restricted conduct and may make compliance with laws, and risk assessment decisions with respect to compliance with laws, difficult and uncertain. In addition, ambiguities make it difficult, in certain circumstances, to determine if, and how compliance violations may be cured. We have in the past and may in the future fail to comply with applicable statutes and regulations even if acting in good faith, or because governmental bodies or courts interpret existing laws or regulations in a more restrictive manner, which have in the past and may in the future lead to regulatory investigations, governmental enforcement actions or private causes of action with respect to our compliance. To resolve issues raised in examinations or other governmental actions, we may be required to take various corrective actions, including changing certain business practices, making refunds or taking other actions that could be financially or competitively detrimental to us. In certain cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals or make a settlement payment to a given party or regulatory body. There is no assurance that any future settlements will not have a material adverse effect on our business.
We hold state licenses that result in substantial compliance costs, and our business would be adversely affected if our licenses are impaired as a result of noncompliance with those requirements.
We currently hold state licenses in connection with our lending activities, student loan servicing activities, and securities business. Although we have transitioned our lending products to SoFi Bank, for as long as SoFi Lending Corp. brokers, purchases or master services or services loans, we must comply with certain state licensing requirements and varying compliance requirements. Changes in licensing laws may result in increased disclosure requirements, increased fees, or may impose other conditions to licensing that we or our personnel are unable to meet. In most states in which we operate, a regulatory agency or agencies regulate and enforce laws relating to loan servicers, brokers, and originators, and collection agencies. We are subject to periodic examinations by state and other regulators in the jurisdictions in which we conduct business, which can result in increases in our administrative costs and refunds to borrowers of certain fees earned by us, and we may be required to pay substantial penalties imposed by those regulators due to compliance errors, or we may lose our license or our ability to do business in the jurisdiction otherwise may be impaired. Fines and penalties incurred in one jurisdiction may cause investigations or other actions by regulators in other jurisdictions.
We may not be able to obtain or maintain all currently required licenses and permits. If we change or expand our business activities, we may be required to obtain additional licenses before we can engage in those activities. If we apply for a new license, a regulator may determine that we were required to do so at an earlier point in time, and as a result, may impose penalties or refuse to issue the license, which could require us to modify or limit our activities in the relevant state. For example, we have been fined in the past by state regulators for engaging in financial services related activities prior to obtaining a license. Based on changes to our businesses, we may also forfeit certain of our licenses that are no longer required. Regulators may impose conditions, requirements or penalties in connection with the forfeiture of any of our licenses.
States may also expand or otherwise modify their current regulations and if such states so act, we may not be able to comply with such updated regulations or maintain all requisite licenses and permits in such states or our costs of compliance with and maintenance of such licenses or permits may materially increase. For example, California, Colorado and Maine have implemented additional regulations related to student loan servicers which impose additional registration, reporting and disclosure requirements and which, if applicable to us, may increase our costs of servicing loans in those states.
In addition, the states that currently do not provide extensive regulation of our business may later choose to do so, and if such states so act, we may not be able to obtain or maintain all requisite licenses and permits, which could require us to modify or limit our activities in the relevant state or states. The failure to satisfy those and other regulatory requirements could result in a default under our warehouse facilities, other financial arrangements and/or servicing agreements and thereby have a material adverse effect on our business, financial condition and results of operations.
Our compliance and risk management policies and procedures as a bank, bank holding company and otherwise regulated financial services company may not be fully effective in identifying or mitigating compliance and risk exposure in all market environments or against all types of risk.
As a bank, a bank holding company and a financial services company operating in the banking and securities industry, among others, our business exposes us to a number of heightened risks. We have devoted significant resources to developing our compliance and risk management policies and procedures and will continue to do so, but there can be no assurance these are sufficient, especially as our business is rapidly growing and evolving. Nonetheless, our limited operating history in many of the products we offer, our evolving business and our rapid growth make it difficult to predict all of the risks and challenges we may encounter and may increase the risk that our policies and procedures that serve to identify, monitor and manage compliance

64

SoFi Technologies, Inc.
TABLE OF CONTENTS

risks may not be fully effective in mitigating our exposure in all market environments or against all types of risk. Further, certain controls are manual and are subject to inherent limitations and errors in oversight. This could cause our compliance and other risk management strategies to be ineffective. Other compliance and risk management methods depend upon the evaluation of information regarding markets, customers, catastrophic occurrences or other matters that are publicly available or otherwise accessible to us, which may not always be accurate, complete, up-to-date or properly evaluated. Insurance and other traditional risk-shifting tools may be held by or available to us in order to manage certain exposures, but they are subject to terms such as deductibles, coinsurance, limits and policy exclusions, as well as risk of counterparty denial of coverage, default or insolvency. Any failure to maintain effective compliance and other risk management strategies could have an adverse effect on our business, financial condition and results of operations.
We are also exposed to heightened regulatory risk because our business is subject to extensive regulation and oversight in a variety of areas, and such regulations are subject to evolving interpretations and application and it can be difficult to predict how they may be applied to our business, particularly as we introduce new products and services and expand into new jurisdictions. For example, the regulatory landscape involving digital assets is constantly evolving and we recently relaunched our digital assets offering.
Also, due to market volatility, it is difficult to predict how much capital we will need in the future to meet net capital requirements. Any perceived or actual breach of laws and regulations could negatively impact our business, financial condition or results of operations. It is possible that these laws and regulations could be interpreted or applied in a manner that would prohibit, alter or impair our existing or planned products and services.
Regulatory scrutiny of banking as a service, or BaaS, solutions has increased and may require us to devote significant resources to enhancing our Technology Platform policies, procedures, operations, controls and products, and the failure to satisfy such increased scrutiny may cause regulators to take action against us or our BaaS partners, or result in a loss of one or more of our BaaS partners.
Our Technology Platform facilitates the provision of BaaS products and services to third parties through various card, deposit, payment, transfer, credit and lending solutions that allow financial technology companies or other third parties to, among other things, connect to sponsor banks’ systems directly via application programming interfaces and cloud infrastructure so they can build banking offerings on top of the sponsor banks’ regulated infrastructure. In addition, our Technology Platform offers an end-to-end core banking platform solution with integrated payment processing. Furthermore, in connection with our Technology Platform's BaaS solutions, we sometimes offer certain program management, data, analytics, compliance and risk management functions, including managing anti-money laundering and fraud risks. The third parties that use these BaaS solutions include a variety of financial entities, including banks, fintech companies and other financial intermediaries. SoFi Bank is one of the sponsor banks that utilizes our BaaS products and services and may continue to do so in the future.
Federal bank regulators have increasingly focused on the risks related to BaaS solutions, including risk management, oversight, internal controls, information security, change management and information technology operational resilience, as well as potential systemic risk posed by BaaS solutions to the larger banking industry. Recently, regulators have even brought enforcement actions against financial entities that have allegedly not adequately addressed these concerns while growing their BaaS offerings. Regulators have specifically required these financial entities to enhance oversight of third-party fintech partnerships, improve control frameworks related to anti-money laundering and BSA compliance, and adopt, implement and adhere to revised and expanded risk-based policies, procedures and processes. If we or any of the fintech clients or sponsor bank partners supported by our Technology Platform were to face regulatory actions that limit the growth of our or their fintech business, or if we were forced to stop growing our Technology Platform, or if any of our fintech clients or sponsor banks were to limit or cease their participation in BaaS solutions, this could have a negative impact on our revenue and results of operation for the Technology Platform segment.
Furthermore, regulatory scrutiny of BaaS solutions extends directly to middleware providers, such as our Technology Platform, which, in certain circumstances, bear accountability for their partners’ compliance and risk management, including with respect to penalties, fines, and other measures that bank regulatory agencies take in the event of non-compliant activity or risks that are not well controlled. This is particularly true when the BaaS solution includes program management, and compliance and risk management controls, including managing anti-money laundering and fraud risks. In addition, as our fintech and sponsor bank partners face increased regulatory scrutiny, their scrutiny of our services will likely increase and our inability to satisfactorily respond to partner demands could result in those partners moving to different solutions. Assessing and managing risk for our Technology Platform clients in the face of regulatory and client scrutiny has in the past and will continue to require us to devote significant resources to enhancing relevant policies, procedures, operations and products. Finally, as a subsidiary of a bank holding company, any failure of our Technology Platform's BaaS solutions to withstand regulatory scrutiny could reflect badly on our relationship with our regulators and on our overall reputation.

65

SoFi Technologies, Inc.
TABLE OF CONTENTS

While we believe we are a leader in managing, monitoring and overseeing BaaS relationships with third parties and corresponding technologies, if we are not successful in continuing to enhance our controls for assessing and managing the third-party, anti-money laundering, fraud and information technology risks stemming from certain of our fintech and sponsor bank partnerships, we could be subject to additional regulatory scrutiny with respect to that portion of our business which could subject us to regulatory fines or other penalties, or business or reputational harm, and could adversely affect our financial condition and results of operations.
We may become subject to enforcement actions or litigation as a result of our failure to comply with laws and regulations, even though noncompliance was inadvertent or unintentional.
We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations; however, certain legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there were systems and procedures designed to ensure compliance in place at the time.
For example, we engage in outbound telephone and text communications with consumers, and accordingly must comply with a number of federal and state statutes and regulations that regulate certain such communications, including the TCPA and Telemarketing Sales Rules. The U.S. Federal Communications Commission (the “FCC”), and the FTC have responsibility for regulating various aspects of certain of these federal laws. Among other requirements, the TCPA requires us to obtain prior express written consent for certain telemarketing calls and to adhere to “do-not-call” registry requirements which, in part, mandate we maintain and regularly update lists of consumers who have chosen not to be called and restrict certain calls for marketing purposes to consumers whose numbers are properly registered on the national do-not-call list. Further, in late 2023 and early 2024, the FCC introduced various new TCPA requirements relating to, among other things, lead generation, prior express written consent to marketing calls made with certain telephony technology and processing opt-outs and do not call requests. These new requirements went into effect in January 2025. In addition to federal laws, many states also have mini-TCPA and other similar consumer protection laws regulating certain telemarketing calls directed to their residents. Collectively, these federal and state laws limit our ability to communicate with consumers through calls and text messages and reduce the effectiveness of our marketing programs. As construed by certain courts, the TCPA and certain state mini-TCPA laws do not distinguish between voice and data, and, as such, SMS/MMS messages are also “calls” for the purpose of these laws. Other state mini-TCPA laws expressly include SMS/MMS messages within their scope.
For violations of the TCPA, the law provides for a private right of action under which a plaintiff may recover monetary statutory damages of $500 for each call or text made in violation of the statute. A court may treble the $500 amount upon a finding of a willful or knowing violation. There is no statutory cap on maximum aggregate exposure for TCPA violations (although certain courts have applied in TCPA class actions constitutional limits on excessive penalties). Like the TCPA, several mini-TCPA and other similar state laws also provide for a private right of action under which a plaintiff may recover statutory damages of $500 or more for each violative call or text and enhanced statutory damages if the violation is knowing or willful. An action may be brought by the FCC, a state attorney general, an individual, or a class of individuals. Like other companies that rely on telephone and text communications, we may be subject to putative class action suits alleging violations of the TCPA, and state mini-TCPA and other similar state laws. If in the future we are found to have violated any federal or state law regulating telemarketing, the amount of damages and potential liability could be extensive and adversely impact our business.
In addition, we use credit reports in our credit decisioning processes and, accordingly, must comply with FCRA which requires a permissible purpose to obtain a consumer credit report and requires persons that furnish loan payment information to credit bureaus to report such information accurately. We are also required to perform a reasonable investigation in the event we receive indirect disputes from the credit bureaus about the accuracy of our credit reporting for a particular consumer and to update any inaccurate information we discover. Although we have policies and procedures in place to comply with FCRA, we are subject to lawsuits alleging that we failed under FCRA to adequately investigate indirect disputes over credit reporting which we receive from one or more credit bureaus. We have experienced an increase in such FCRA claims since our business has grown and even if we are ultimately successful in defending against such suits, they could involve substantial time and expense to analyze and respond to, could divert management’s attention and other resources from running our business, and could lead to settlements, judgments, fines, penalties or injunctive relief. We are also subject to contractual requirements governing our use of credit reports established by the credit bureaus from whom we receive the reports. If credit reporting data is accessed, used, disclosed, or retained in a manner that is inconsistent with those contractual requirements — whether due to employee misconduct, system error, third-party service provider failure, cyberattack, or otherwise — we could be subject to contractual claims, indemnification obligations, and remediation costs. In addition, we could be required to suspend or limit access to certain data sources, which could adversely affect our underwriting, fraud prevention, marketing, or servicing

66

SoFi Technologies, Inc.
TABLE OF CONTENTS

operations. Any such event could also result in reputational damage, loss of consumer trust, adverse media coverage, increased compliance costs, and harm to our business, financial condition, and results of operations.
Changes in applicable laws and regulations, as well as changes in government enforcement policies and priorities, may negatively impact the management of our business, results of operations, ability to offer certain products or the terms and conditions upon which they are offered, and ability to compete.
Financial services regulation is constantly changing, and new laws or regulations, or new interpretations of existing laws or regulations, could have a materially adverse impact on our ability to operate as currently intended, and cause us to incur significant expense in order to ensure compliance. Federal and state financial services regulators are also enforcing existing laws, regulations, and rules aggressively and enhancing their supervisory expectations regarding the management of legal and regulatory compliance risks. These regulatory changes and uncertainties make our business planning more difficult and could result in changes to our business model and potentially adversely impact our results of operations. Furthermore, to the extent applicable, these laws can impose specific statutory liabilities upon creditors who fail to comply with their provisions and may affect the enforceability of a loan.
Proposals to change the statutes affecting financial services companies are frequently introduced in Congress and state legislatures that, if enacted, may affect their operating environment in substantial and unpredictable ways. In addition, numerous federal and state regulators and SROs have the authority to promulgate or change regulations that could have a similar effect on our operating environment. We cannot determine with any degree of certainty whether any such legislative or regulatory proposals will be enacted and, if enacted, the ultimate impact that any such potential legislation or implementing regulations, or any such potential regulatory actions by federal or state regulators, would have upon our business.
New laws, regulations, policy or changes in enforcement of existing laws or regulations applicable to our business, or reexamination of current practices, could adversely impact our profitability, limit our ability to continue existing or pursue new business activities, require us to change certain of our business practices, affect retention of key personnel, or expose us to additional costs (including increased compliance costs and/or customer remediation). These changes have in the past and may in the future require us to invest significant resources, and devote significant management attention, to make any necessary changes and could adversely affect our business. For example, on October 13, 2023, the SEC adopted rules relating to providing additional disclosures in the securities lending market. These rules require any covered person that loans a reportable security on behalf of itself or another person to report certain material terms of those loans and related information to FINRA by the end of the day on which the loan is effected. FINRA in turn will make certain information it receives publicly available by the next business day. These regulations could make securities lending more costly, leading to less overall lending activity and a decrease in revenue. On February 22, 2024, the SEC adopted amendments to Rule 605 under the Exchange Act that requires disclosures for order executions in national market system (“NMS”) stocks. The amendments modify the type of information required to be disclosed under Rule 605 and expand the scope of reporting entities subject to Rule 605 to include broker-dealers who introduce or carry 100,000 or more customer accounts. Modifications to Rule 605 include new definitions, new and modified categories of order types, and new statistical measures of execution quality and other metrics. New execution quality reporting requires granular, public monthly reports, including fractional shares and stop orders. Errors or unfavorable public metrics could harm our reputation and result in enforcement risk. In May 2024, the SEC adopted amendments to Regulation S-P (“Reg S-P”) which went into effect for large covered institutions (including SEC-registered investment advisers with $1.5 billion in assets under management, investment companies with $1 billion in net assets and all broker-dealers that are not small institutions under the Exchange Act) in December 2025, and will go into effect for all other covered institutions in June 2026. The finalized amendments to Reg S-P are designed to address the expanded use of technology and corresponding risks that have emerged since Reg S-P's original adoption and modernize and improve the protection of consumer financial information by certain financial institutions, also known as "covered institutions" (including broker-dealers and investment advisers). As adopted, amended Reg S-P (i) requires covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information; (ii) requires that the response program include procedures for covered institutions to provide timely notification to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization; and (iii) broadens the scope of information covered by Regulation S-P's requirements. Failure to meet these obligations, or the failures of vendors on whom we rely, could lead to enforcement actions, litigation and significant costs. On September 18, 2024, the SEC adopted rules that would (i) amend Rule 612 of Regulation NMS to establish a new minimum pricing increment, also known as a tick size, of $0.005 for the quoting of certain NMS stocks; (ii) reduce the access fee caps applicable to stock exchanges under Rule 610 of Regulation NMS (from $0.003 per share (i.e., 30 mils) to $0.001 per share (i.e., 10 mils) and require national securities exchanges to make the amounts of all fees and rebates determinable at the time of execution; and (iii) accelerate the implementation of the round lot and odd-lot information definitions adopted in 2020 under the Market Data Infrastructure Rules (“MDI Rules”) and add information about the best odd-lot order to the definition of odd-lot information. On December 20, 2024, the SEC adopted changes to SEC Rule

67

SoFi Technologies, Inc.
TABLE OF CONTENTS

15c3-3 and 15c3-1 that modify how broker-dealers protect customer assets and calculate their minimum required “net capital.” These changes, particularly the amendments to Rule 612 and 610 of Regulation NMS, will likely affect the economics for orders executed on national stock exchanges and as a result may impact order routing and order execution decisions by market participants, including third parties on which we rely, like clearing brokers. See “ Business, Financial and Operational Risks — We rely on third parties to perform certain key functions, and their failure to perform those functions could adversely affect our business, financial condition and results of operations ”. Compliance with this rule may impose additional cost on our business. In addition, SoFi Securities’ ability to generate revenue may be impacted as a result of the changes in stock exchange fee caps and the resulting potential changes in order routing and execution decisions. The ultimate effect of these potential changes is uncertain and may impact how SoFi Securities manages and evaluates its compliance with other obligations, such as its obligation to achieve best execution for customer orders.
See also “ Lawmakers, regulators and other public officials have signaled an increased focus on new or additional laws or regulations that could impact our broker-dealer business and require us to make significant changes to our business model and practices and could result in significant costs to our business or loss of current revenue streams ”. Compliance with each of these rules, when applicable and if required, would impose additional costs on our business. To the extent such proposals affect the equity market structure more broadly, our ability to generate revenue may be impaired. There is also the risk that, despite our best efforts, the SEC or FINRA does not view our compliance measures as sufficient. This risk is substantially elevated where regulators adopt a substantial number of new rules in a short time frame. In addition, non-compliance with any adopted requirements would likely result in enforcement action by the SEC or FINRA.
Extensive regulation and supervision have a negative impact on our ability to compete in a cost-effective manner and may subject us to material compliance costs and penalties.
The Company, primarily through its subsidiary SoFi Bank and certain non-bank subsidiaries, is subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect depositors’ funds, federal deposit insurance funds and the banking system as a whole. Many laws and regulations affect our lending practices, capital structure, investment practices, dividend policy and growth, among other things. They encourage us to ensure a satisfactory level of lending in defined areas and establish and maintain comprehensive programs relating to anti-money laundering and customer identification. Congress, state legislatures, and federal and state regulatory agencies continually review banking laws, regulations and policies for possible changes. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect us in substantial and unpredictable ways. Such changes could subject us to additional costs, limit the types of financial services and products it may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things. Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations.
We are subject to the risk that regulatory or enforcement agencies and/or consumer advocacy groups may assert that our business practices may violate certain rules, laws and regulations, including anti-discrimination statutes.
Anti-discrimination statutes, such as the FHA and the ECOA and state law equivalents, prohibit creditors from discriminating against loan applicants and borrowers based on certain characteristics, such as race, religion and national origin. Various federal regulatory and enforcement departments and agencies, including the Department of Justice and CFPB, take the position that these laws apply not only to intentional discrimination, but also to facially neutral practices that have a disparate impact on a group that shares a characteristic that a creditor may not consider in making credit decisions. State and federal regulators, as well as consumer advocacy groups and plaintiffs’ attorneys, are focusing greater attention on “disparate impact” claims. Similarly, these regulatory agencies and litigants could take the position that the geographical footprint within which we conduct lending activity or the manner in which we advertise loans, disproportionately excludes potential borrowers belonging to a protected class, and constitutes unlawful “redlining”. Although we utilize an automated underwriting process to originate loans, we frequently adjust pricing strategies which increases our risk of inadvertently violating the FHA and the ECOA. These regulatory agencies could also take the position that the underwriting or credit models or algorithms we use produce disparate outcomes or do not produce sufficient information about a credit decision to satisfy applicant notification requirements under ECOA. In addition to reputational harm, violations of the FHA and the ECOA can result in actual damages, punitive damages, injunctive or equitable relief, attorneys’ fees and civil money penalties.
Our investment adviser and broker-dealer subsidiaries are subject to regulation by the SEC and FINRA.
We offer investment management services through the Investment Adviser which offers investment management services in connection with our robo-advisory accounts. The Investment Adviser is registered as an investment adviser under the Advisers Act, which does not imply any level of skill or training, and is subject to regulation by the SEC. SoFi Securities is

68

SoFi Technologies, Inc.
TABLE OF CONTENTS

an affiliated SEC-registered broker-dealer and FINRA member. We offer cash management accounts, which are brokerage products, through SoFi Securities.
The Investment Adviser operates in a highly regulated environment and is subject to, among other things, the anti-fraud provisions of the Advisers Act and to fiduciary duties derived from these provisions that apply to its relationships with our members who are its advisory clients. These provisions and duties also impose certain restrictions and obligations on us with respect to our dealings with our members and our investments, including for example restrictions on transactions with our affiliates. Our Investment Adviser is also subject to other requirements under the Advisers Act and related regulations. These additional requirements relate to matters including, among others, maintaining an effective and comprehensive compliance programs and record-keeping and reporting and disclosure requirements. In recent years, the SEC proposed and, in certain cases, adopted amendments to the Advisers Act rules, which present a number of additional significant and burdensome compliance challenges for registered investment advisers. In addition, our Investment Adviser has been in the past, and will be in the future, subject to SEC examination. Moreover, the Advisers Act generally grants the SEC broad administrative powers, including the power to limit or restrict an investment adviser from conducting advisory activities in the event it fails to comply with federal securities laws. The Investment Adviser is also subject to applicable state securities laws. Additional sanctions that may be imposed for failure to comply with applicable requirements include prohibitions of individuals from associating with an investment adviser, the revocation of registration and other censures and fines. Even if an investigation or proceeding did not result in a sanction or the sanction imposed against us or our personnel by a regulator was small in monetary amount, the adverse publicity relating to the investigation, proceeding or imposition of these sanctions could harm our reputation and cause us to lose existing members or fail to gain new members. See Part I, Item 3. “ Legal Proceedings ”.
Our subsidiary, SoFi Securities, is an affiliated SEC-registered broker-dealer and FINRA member. The securities industry is highly regulated, including under federal, state and other applicable laws, rules and regulations, and we may be adversely affected by regulatory changes related to suitability of financial products, supervision, sales practices, advertising, application of fiduciary standards, best execution and market structure, any of which could limit our business and damage our reputation. FINRA has adopted extensive regulatory requirements relating to sales practices, advertising, registration of personnel, compliance and supervision, and compensation and disclosure, to which SoFi Securities and its personnel are subject. For example, FINRA’s 2026 Annual Regulatory Oversight Report included new topics, such as the third party risk landscape, extended hours trading, and registered index-linked annuities, and expanded guidance on AI, cybersecurity, AML/sanctions, and best execution/order routing disclosures, among others. FINRA is explicitly focused on vendor outages and cyber incidents, generative AI-enabled fraud, and controls over fractional shares and after hours trading. The SEC 2026 exam priorities also identify areas such as generative AI and Regulation Best Interest (“Reg BI”) as focus areas. Our use of any AI-enabled tools could draw scrutiny, or failures in any of these areas could result in examination findings, sanctions or customer harm. In addition, sales of complex products and account type recommendations face heightened enforcement under Reg BI. Both the SEC and FINRA remain focused on surveilling off-channel communications and associated recordkeeping violations. If associated persons use unapproved channels (e.g., personal messaging apps) and records are not preserved, we could face substantial penalties and remediation costs. FINRA and the SEC also have the authority to conduct examinations of SoFi Securities and may also conduct administrative proceedings. Additionally, material expansions of the business in which SoFi Securities engages are subject to approval by FINRA. This could delay, or even prevent, the firm’s ability to expand its securities and brokerage offerings in the future. Furthermore, SoFi Securities is subject to increased governance in its role as an affiliate of a national bank under guidance from the OCC regarding RNDIPs. OCC guidance, which was further updated in June 2024, requires that banks implement effective oversight and monitoring of relevant RNDIP arrangements to ensure that, among other things, sales transactions and recommendations to retail investors comply with SEC regulations. Such oversight and monitoring may increase costs for SoFi Securities and SoFi Bank and could have a material adverse effect on our business, financial condition and results of operations, and any failure by SoFi Bank to effectively oversee and monitor such arrangements could result in harm to members and financial and reputational harm to us.
From time to time, SoFi Securities and the Investment Adviser may be threatened with or named as a defendant in lawsuits, arbitrations and administrative claims. As previously noted, these entities are also subject to regulatory examinations and inspections by regulators (including the SEC and FINRA, as applicable). Compliance and trading problems or other deficiencies or weaknesses that are reported to regulators, such as the SEC and FINRA, by dissatisfied members or others, or that are identified by regulators themselves are investigated by such regulators, and may, if pursued, result in formal claims being filed against SoFi Securities and the Investment Adviser by members or disciplinary action being taken by regulators against us or our personnel. Our failure to comply with applicable laws or regulations or our own policies and procedures could result in fines, litigation, suspensions of personnel or other sanctions, which could have a material effect on our overall financial results. For example, in December 2023, FINRA found that SoFi Securities failed to establish, maintain, and enforce a supervisory system reasonably designed to supervise its fully paid securities lending offerings. Even if a sanction imposed against us or our personnel is small in monetary amount, the adverse publicity arising from the imposition of sanctions against us by regulators could harm our reputation and our brand and lead to material legal, regulatory and financial exposure

69

SoFi Technologies, Inc.
TABLE OF CONTENTS

(including fines and other penalties), cause us to lose existing members or fail to gain new members. In addition, in the normal course of business, SoFi Securities and the Investment Adviser discuss matters raised by its regulators during regulatory examinations or otherwise upon their inquiry. These matters could also result in censures, fines, penalties or other sanctions.
In addition to the broker-dealer proposals described above under “ Changes in applicable laws and regulations, as well as changes in government enforcement policies and priorities, may negatively impact the management of our business, results of operations, ability to offer certain products or the terms and conditions upon which they are offered, and ability to compete ”, a substantial number of proposed rules for investment advisers were introduced in 2023 and 2024 and subsequently withdrawn in 2025. These withdrawn proposed rules covered material regulatory topics, including: (i) environmental, social, and governance issues for investment advisers and funds; (ii) outsourcing by investment advisers; and (iii) safeguarding and custody of client assets. A fourth proposed rule regarding expansion of the scope of activities and relationships that make a person an investment advice fiduciary under Section 3(21) of the Employee Retirement Income Security Act of 1974 and Section 4975 of the Internal Revenue Code (the “Retirement Security Rule”) was stayed by two Fifth Circuit federal district courts, and the Department of Labor (the “DOL”) decided not to appeal the decisions. The DOL’s regulatory agenda for Spring 2025, however, included a new “fiduciary rule” set to be issued by May 2026. If any of the foregoing rules is re-proposed and enacted, compliance would impose additional costs on our business. There is also the risk that, despite our best efforts, the SEC does not view our compliance measures as sufficient.
Failure to comply with anti-money laundering, economic and trade sanctions regulations, and similar laws could subject us to penalties and other adverse consequences.
Various laws and regulations in the U.S. and abroad, such as the BSA, the Dodd-Frank Act, the USA PATRIOT Act, and the Credit Card Accountability Responsibility and Disclosure Act, impose certain anti-money laundering requirements on companies that are financial institutions or that provide financial products and services. Under these laws and regulations, financial institutions are broadly defined to include banks and MSBs such as money transmitters. In 2013, FinCEN issued guidance regarding the applicability of the BSA to administrators and exchangers of convertible virtual currency, clarifying that they are MSBs, and more specifically, money transmitters. The BSA requires banks and MSBs to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records, among other requirements. In addition, our contracts with financial institution partners and other third parties may contractually require us to maintain an anti-money laundering program. SoFi Bank is subject to the regulatory and supervisory jurisdiction of the OCC with respect to the BSA and its implementing regulations applicable to banks, and the Company and its non-bank subsidiaries, including our technology platform, are subject to the regulatory and supervisory jurisdiction of the Federal Reserve with respect to anti-money laundering and sanctions regulations.
We are also subject to economic and trade sanctions programs administered by OFAC, which prohibit or restrict transactions to or from or dealings with specified countries, their governments, and in certain circumstances, their nationals, and with individuals and entities that are specially-designated nationals of those countries, narcotics traffickers, terrorists or terrorist organizations, and other sanctioned persons and entities.
Our failure to comply with anti-money laundering, economic and trade sanctions regulations, and similar laws could subject us to substantial civil and criminal penalties, or result in the loss or restriction of our national bank charter or broker-dealer registrations and state licenses, or liability under our contracts with third parties, which may significantly affect our ability to conduct certain aspects of our business. Changes in this regulatory environment, including changing interpretations and the implementation of new or varying regulatory requirements by the government, may significantly affect or change the manner in which we currently conduct certain aspects of our business.
We are subject to anti-corruption, anti-bribery and similar laws, and noncompliance with such laws can subject us to significant adverse consequences, including criminal or civil liability, and harm our business.
We are subject to the Foreign Corrupt Practices Act, U.S. domestic bribery laws and other U.S. and foreign anti-corruption laws. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees and their third-party intermediaries from authorizing, offering or providing, directly or indirectly, improper payments or benefits to recipients in the public sector. These laws also require that we keep accurate books and records and maintain internal controls and compliance procedures designed to prevent any such actions. Although our operations are currently concentrated in the U.S., as we increase our international cross-border business and expand operations abroad, we have engaged and may further engage with business partners and third-party intermediaries to market our services and to obtain necessary permits, licenses and other regulatory approvals. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities. The

70

SoFi Technologies, Inc.
TABLE OF CONTENTS

failure to comply with any such laws could subject us to criminal or civil liability, cause us significant reputational harm and have an adverse effect on our business, financial condition and results of operations.
We conduct our business operations through subsidiaries and may in the future rely on dividends from our subsidiaries for a substantial amount of our cash flows.
We may in the future depend on dividends, distributions and other payments from our subsidiaries to fund payments on our obligations, including any debt obligations we may incur. Regulatory and other legal restrictions may limit our ability to transfer funds to or from certain subsidiaries, including SoFi Securities and SoFi Bank. In addition, certain of our subsidiaries are subject to laws and regulations that authorize regulatory bodies to block or reduce the flow of funds to us, or that prohibit such transfers altogether in certain circumstances. These laws and regulations may hinder our ability to access funds that we may need to make payments on our obligations, including any debt obligations we may incur and otherwise conduct our business by, among other things, reducing our liquidity in the form of corporate cash. In addition to negatively affecting our business, a significant decrease in our liquidity could also reduce investor confidence in us. Certain rules and regulations of the SEC and FINRA may limit the extent to which our broker-dealer subsidiaries may distribute capital to us. For example, under FINRA rules applicable to SoFi Securities, a dividend in excess of 10% of a member firm’s excess net capital may not be paid without FINRA’s prior written approval. In addition, the OCC has the authority to use its enforcement powers to prohibit a bank from paying dividends if, in its opinion, the payment of dividends would constitute an unsafe or unsound practice. Federal law also prohibits the payment of dividends by a bank that will result in the bank failing to meet its applicable capital requirements on a pro forma basis. In addition, under the National Bank Act, SoFi Bank generally may, without prior approval of the OCC, declare a dividend but only so long as the total amount of all dividends (common and preferred), including the proposed dividend, in the current year do not exceed net income for the current year to date plus retained net income for the prior two years. Compliance with these rules may impede our ability to receive dividends, distributions and other payments from SoFi Securities and SoFi Bank.
We have in the past, continue to be, and may in the future be subject to inquiries, exams, pending investigations, or enforcement matters.
The financial services industry is subject to extensive regulation and oversight under federal, state, and applicable international laws. From time to time, in the normal course of business, we have received and may receive or be subject to inquiries or investigations by state and federal regulatory or enforcement agencies and bodies, such as the CFPB, SEC, the Federal Reserve, the OCC, the FDIC, the FHFA, the VA, the state attorneys general, state financial regulatory agencies, other state or federal agencies and SROs like FINRA. We also have in the past and may in the future receive inquiries from state regulatory agencies regarding requirements to obtain licenses from or register with those states, including in states where we have previously determined that we are not required to obtain such a license or be registered with the state. In addition, we have been threatened with or named as a defendant in lawsuits, arbitrations and administrative claims involving securities, consumer financial services and other matters. We are also subject to periodic regulatory examinations and inspections. Compliance and trading problems or other deficiencies or weaknesses that are reported to regulators, such as the OCC, SEC, FINRA, the CFPB or state regulators, by dissatisfied customers or others, or that are identified by regulators themselves, are investigated by such regulators, and may, if pursued, result in formal claims being filed against us by customers or disciplinary action being taken against us or our employees by regulators or enforcement agencies. In addition, we could be required to disclose such federal, state, or local government actions or court orders to others who have supervisory or enforcement authority over us, which could be time consuming and costly, increase demand on our systems and resources and adversely impact our reputation. To resolve issues raised in examinations or other governmental actions, we may be required to take various corrective actions, including changing certain business practices, making refunds or taking other actions that could be financially or competitively detrimental to us.
Any such inquiries, investigations, lawsuits, arbitrations, administrative claims or other inquiries have in the past and could in the future involve substantial time and expense to analyze and respond to, divert management’s attention and other resources from running our business, and lead to fines, penalties, injunctive relief, and the need to obtain additional licenses that we do not currently possess. Our involvement in any such matters, whether tangential or otherwise and even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation, lead to additional investigations and enforcement actions from other agencies or litigants, and further divert management attention and resources from the operation of our business. As a result, the outcome of legal and regulatory actions arising out of any state or federal inquiries we receive could have a material adverse effect on our business, financial condition or results of operations.

71

SoFi Technologies, Inc.
TABLE OF CONTENTS

Lawmakers, regulators and other public officials have signaled an increased focus on new or additional laws or regulations that could impact our broker-dealer business and require us to make significant changes to our business model and practices and could result in significant costs to our business or loss of current revenue streams.
Various lawmakers, regulators and other public officials have made statements about business practices in which we and other broker-dealers engage, including SoFi Securities, and signaled potential new or additional laws or regulations that, if acted upon, could impact our business. For example, a focus by regulators and lawmakers on PFOF, exchange rebates, and related conflicts of interest have resulted in new proposed rules. Additionally, the SEC has proposed new requirements regarding PFOF and a rule to prohibit volume-based transaction pricing in connection with the execution of agency-related orders in national market system stock. The SEC also issued an order in September 2023 directing the equity exchanges and FINRA to file a new national marketing system plan, on which the SEC is soliciting comments. This order and other proposals have the potential to substantially reshape U.S. equities markets in intended and unintended ways, and to substantially alter existing order routing, execution incentives and business practices.
To the extent that the SEC, FINRA or other regulatory authorities or legislative bodies adopt additional regulations or legislation in respect of any of these areas or relating to any other aspect of our business, we could face a heightened risk of potential regulatory violations and could be required to make significant changes to our business model and practices, which changes may not be successful. Any of these outcomes could have an adverse effect on our business, financial condition and results of operations. Additionally, any negative publicity surrounding PFOF practices generally, or our implementation of this practice, could harm our brand and reputation. For more information about the potential impact of legal and regulatory changes, see “ We may become subject to enforcement actions or litigation as a result of our failure to comply with laws and regulations, even though noncompliance was inadvertent or unintentional ”.
Regulations relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information, and adversely affect our business opportunities.
We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by them. For example, we are subject to the GLBA and implementing regulations and guidance. Among other things, the GLBA (i) imposes certain limitations on the ability to share consumers’ nonpublic personal information with nonaffiliated third parties and (ii) requires certain disclosures to consumers about our practices for the collection, sharing and safeguarding of their information and their right to “opt out” of the institution’s disclosure of their personal financial information to nonaffiliated third parties (with certain exceptions). The GLBA and other state laws also require that we implement and maintain certain security measures, policies and procedures to protect personal information.
Furthermore, legislators and/or regulators are increasingly adopting new and/or amending existing privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices; our policies and practices related to the collection, use, sharing, retention and safeguarding of consumer and/or employee information; and certain of our current or planned business activities. New requirements, originating from new or amended laws, could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. The CFPB, for example, finalized its Personal Financial Data Rights Rule, which could require us to build an application that allows our customers to obtain their personal financial information and for authorized third parties to obtain our customers’ information and to implement privacy protections if we seek consumer financial data from another financial institution, as an authorized third party of a consumer. Although the rule’s original compliance deadlines are currently stayed as part of ongoing litigation, and are not being enforced while the CFPB reconsiders the rule, if implemented this could increase our compliance costs, volatility in our customer base, and the risk of fraudulent access to consumers’ personal financial information.
Compliance with current or future privacy, information security and data protection laws (including those regarding security breach notification) affecting customer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve sharing information with third parties or storing sensitive credit card information), which could materially and adversely affect our profitability. A failure by us or a third-party contractor providing services to us to comply with applicable data privacy and security laws, regulations, self-regulatory requirements or industry guidelines, or our terms of use with our users, may result in sanctions, statutory or contractual damages or litigation (including class actions) and may subject us to reputational harm. Additionally, there is always a danger that regulators can attempt to assert authority over our business in the area of privacy, information security and data protection. Furthermore, if our vendors and/or service providers are or become subject to laws and regulations in the jurisdictions that have enacted more stringent and expansive legislation applicable to

72

SoFi Technologies, Inc.
TABLE OF CONTENTS

privacy, information and/or data protection, the costs that these vendors and service providers must incur in becoming compliant may be passed along to us, resulting in increasing costs on our business.
Concerns in our ability, perceived or otherwise, to protect the privacy and security of personal information may affect our ability to retain and engage new and existing members, clients, investors, and employees, and thereby affect our financial condition. Furthermore, failure to comply or perceived failure to comply with applicable privacy or data protection laws, rules, and regulations may subject us to examinations, investigations, and general heightened scrutiny that may cause us to modify or cease certain operations or practices, significant liabilities or regulatory fines, penalties or other sanctions. Any of these could damage our reputation and adversely affect our business, financial condition, and results of operations.
Privacy requirements, including notice and opt-out requirements, under the GLBA and FCRA are enforced by the FTC, the OCC and by the CFPB through UDAAP and are a standard component of OCC and CFPB compliance and examinations. State entities also may initiate actions for alleged violations of privacy or security requirements under state law. Our failure to comply with privacy, information security and data protection laws could result in potentially significant regulatory investigations and government actions, litigation, fines or sanctions, consumer or merchant actions and damage to our reputation and brand, all of which could have a material adverse effect on our business.
If we collect and process personal data relating to individuals in the EU or the United Kingdom (the “UK”) as a result of either offering goods or services into the EU or UK, or monitoring the behavior of EU and UK individuals, we will be required to comply with stringent privacy and data protection laws. Within the EU, legislators have adopted the General Data Protection Regulation (the “EU GDPR”), which became effective in May 2018. The EU GDPR will impose additional obligations and risks upon our business when we collect and process personal data about individuals from the EU and UK, which may increase substantially the penalties to which we could be subject in the event of any noncompliance. For example, the EU GDPR imposes a broad range of strict requirements on companies subject to the EU GDPR, including requirements relating to having legal bases and conditions for processing personal data and transferring such personal data outside the European Economic Area (“EEA”) or the UK, including to the U.S., providing details to those individuals regarding the processing of their personal data, keeping personal data secure, having data processing agreements with third parties who process personal data, responding to individuals’ requests to exercise their rights in respect of their personal data, where required reporting security breaches involving personal data to the competent national data protection authority and affected individuals, where required, appointing data protection officers, where required conducting data protection impact assessments for high risk processing, and record-keeping. We may incur substantial expense in complying with obligations imposed by the EU GDPR and we may be required to make significant changes in our business operations, all of which may adversely affect our revenues and our business overall.
In addition, further to the UK’s exit from the EU on January 31, 2020, the EU GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the UK’s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK specific amendments) into UK law, referred to as the “UK GDPR”. The UK GDPR and the UK Data Protection Act 2018 set out the UK’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Noncompliance with the UK GDPR may result in significant monetary penalties. Although the UK is regarded as a third country under the EU GDPR, the EC has issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. The Data (Use and Access) Act 2025 has been enacted in the UK which has the effect of altering the similarities between the UK and EEA data protection regime. The EU has, however, extended the UK’s Adequacy Decision from the EC to December 27, 2031. This may lead to additional compliance costs and could increase our overall risk. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing.
In addition, around the world many jurisdictions outside of Europe are also considering and/or have enacted comprehensive data protection legislation. For example, we are subject to stringent privacy and data protection requirements in Hong Kong. Also, many jurisdictions where we may seek to expand our business in the future are also considering and/or have enacted comprehensive data protection legislation. Additional jurisdictions with stringent data protection laws include Brazil and China.
The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with laws in other jurisdictions or with our existing data management practices or the features of our services and platform capabilities. We therefore cannot yet fully determine the impact existing and/or future laws, rules, regulations and industry

73

SoFi Technologies, Inc.
TABLE OF CONTENTS

standards may have on our business or operations. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the imposition of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations.
Any such laws, rules, regulations and industry standards may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices. Additionally, our customers may be subject to differing privacy laws, rules and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Adherence to such contractual requirements may impact our collection, use, processing, storage, sharing and disclosure of various types of information including financial information and other personal information, and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules and regulations evolve. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business. As we expand our customer base, these requirements may vary from customer to customer, further increasing the cost of compliance and doing business.
We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of data. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so. Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer-protection related laws, regulations, orders or industry standards could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices, which could, individually or in the aggregate, materially and adversely affect our business, financial condition and results of operations.
It may be difficult and costly to protect our intellectual property rights, and we may not be able to ensure their protection.
Our ability to provide our products and services to our members and technology platform clients depends, in part, upon our proprietary technology. We may be unable to protect our proprietary technology effectively, which would allow competitors to duplicate our business processes and know-how, and adversely affect our ability to compete with them. A third party may attempt to reverse engineer or otherwise obtain and use our proprietary technology without our consent. The pursuit of a claim against a third party for infringement of our intellectual property could be costly, and there can be no guarantee that any such efforts would be successful.
In addition, our platform or those of third-party service providers that we utilize may infringe upon claims of third-party intellectual property, and we have and may continue to face intellectual property challenges from such other parties. We may not be successful in defending against any such challenges or in obtaining licenses to avoid or resolve any intellectual property disputes, or in receiving amounts due to us under indemnification obligations from third-party service providers. The costs of defending any such claims or litigation could be significant and, if we are unsuccessful, could result in a requirement that we pay significant damages or licensing fees, which would negatively impact our financial performance. If we cannot protect our proprietary technology from intellectual property challenges, our ability to maintain our platform could be adversely affected.
Certain aspects of our platform include open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.
We incorporate open source software into our proprietary platform and into other processes supporting our business. Such open source software may include software covered by licenses like the GNU General Public License and the Apache License or other open source licenses. The terms of various open source licenses have not been interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that limits our use of the software, inhibits certain aspects of our platform and negatively affects our business operations.
Certain open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use. If portions of our proprietary platform are determined to

74

SoFi Technologies, Inc.
TABLE OF CONTENTS

be subject to an open source license, or if the license terms for the open source software that we incorporate change, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our platform or change our business activities. In addition to risks related to license requirements, the use of open source software can lead to greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with the use of open source software cannot be eliminated and could adversely affect our business.
Litigation, regulatory actions and compliance issues could subject us to significant fines, penalties, judgments, remediation costs, negative publicity, changes to our business model, and requirements resulting in increased expenses.
Our business is subject to increased risks of litigation and regulatory actions as a result of a number of factors and from various sources, including as a result of the highly regulated nature of the financial services industry and the focus of state and federal enforcement agencies on the financial services industry.
From time to time, we are also involved in, or the subject of, reviews, requests for information, investigations and proceedings (both formal and informal) by state and federal governmental agencies and SROs, regarding our business activities and our qualifications to conduct our business in certain jurisdictions, which has in the past and could in the future subject us to significant fines, penalties, obligations to change our business practices and other requirements resulting in increased expenses and diminished earnings. Our involvement in any such matter also has in the past and could in the future cause significant harm to our reputation and divert management attention from the operation of our business, even if the matters are ultimately determined in our favor. Moreover, any settlement, or any consent order or adverse judgment in connection with any formal or informal proceeding or investigation by a government agency, may prompt litigation or additional investigations or proceedings as other litigants or other government agencies begin independent reviews of the same activities. See “ If we fail to comply with federal and state consumer protection laws, rules, regulations and guidance, our business could be adversely affected ” for a discussion of the FTC Consent Order.
In addition, a number of participants in the financial services industry have been the subject of: putative class action lawsuits; state attorney general actions and other state regulatory actions; federal regulatory enforcement actions, including actions relating to alleged unfair, deceptive or abusive acts or practices; violations of state licensing and lending laws, including state usury laws; actions alleging discrimination on the basis of race, ethnicity, gender or other prohibited bases; and allegations of noncompliance with various state and federal laws and regulations relating to originating and servicing consumer finance loans. For example, we entered into a settlement agreement on April 18, 2022 related to a putative class action in which it was alleged that we engaged in unlawful lending discrimination through policies and practices by making applicants who are conditional permanent residents or DACA holders ineligible for loans or eligible only with a co-signer who is U.S. citizen or lawful permanent resident. We made an aggregate payment to the class and the class counsel in an immaterial amount. In addition, as a financial services company, errors in performing settlement functions, including clerical, technological and other errors related to the handling of funds and securities could lead to censures, fines or other sanctions imposed by applicable regulatory authorities as well as losses and liabilities in related lawsuits and proceedings brought by transaction counterparties and others.
The environment of increased regulatory compliance efforts and enhanced regulatory enforcement in the past few years has resulted in significant operational and compliance costs and may prevent us from providing certain products and services. There is no assurance that these regulatory matters or other factors will not, in the future, affect how we conduct our business and, in turn, have a material adverse effect on our business. In particular, legal proceedings brought under state consumer protection statutes or under several of the various federal consumer financial services statutes may result in a separate fine for each violation of the statute, which, particularly in the case of class action lawsuits, could result in damages substantially in excess of the amounts we earned from the underlying activities.
In addition, from time to time, through our operational and compliance controls, we identify compliance and other issues that require us to make operational changes and, depending on the nature of the issue, result in financial remediation to impacted members. These self-identified issues and voluntary remediation payments could be significant, depending on the issue and the number of members impacted, and also could generate litigation or regulatory investigations that subject us to additional risk. See Part I, Item 3. “ Legal Proceedings ”.
Changes in tax law and differences in interpretation of tax laws and regulations may adversely impact our financial statements.
We operate in multiple jurisdictions and are subject to tax laws and regulations of the U.S. federal, state and local and non-U.S. governments. U.S. federal, state and local and non-U.S. tax laws and regulations are complex and subject to varying interpretations. U.S. federal, state and local and non-U.S. tax authorities may interpret tax laws and regulations differently than

75

SoFi Technologies, Inc.
TABLE OF CONTENTS

we do and challenge tax positions that we have taken. This may result in differences in the treatment of revenues, deductions, credits and/or differences in the timing of these items. The differences in treatment may result in payment of additional taxes, interest or penalties that could have an adverse effect on our financial condition and results of operations. Further, future changes to U.S. federal, state and local and non-U.S. tax laws and regulations could increase our tax obligations in jurisdictions where we do business or require us to change the manner in which we conduct certain aspects of our business. Proposals to reform U.S. and foreign tax laws could significantly impact how U.S. multinational corporations are taxed on foreign earnings and could increase the U.S. corporate tax rate. Several of the proposals currently being considered, if enacted, could have an adverse impact on our future effective tax rate, income tax expense, and cash flows. Further, the Organisation for Economic Co-operation and Development (the “OECD”) has issued guidelines that change long-standing tax principles and certain countries have adopted OECD guidelines. These guidelines create tax uncertainty as countries amend their tax laws to adopt certain parts of the guidelines.
We will be adversely affected if we, or any of our subsidiaries, are determined to have been subject to registration as an investment company under the Investment Company Act.
We are currently not deemed to be an “investment company” subject to regulation under the Investment Company Act of 1940, as amended (the “Investment Company Act”). No opinion or no-action position has been requested of the SEC on our status as an Investment Company. There is no guarantee we will continue to be exempt from registration under the Investment Company Act and were we to be deemed to be an investment company under the Investment Company Act, and thus subject to regulation under the Investment Company Act, the increased reporting and operating requirements could have an adverse impact on our business, operating results, financial condition and prospects.
In addition, if the SEC or a court of competent jurisdiction were to find that we are in violation of the Investment Company Act for having failed to register as an investment company thereunder, possible consequences include, but are not limited to, the following: (i) the SEC could apply to a district court to enjoin the violation; (ii) we could be sued by investors in us and in our securities for damages caused by the violation; and (iii) any contract to which we are a party that is made in, or whose performance involves a, violation of the Investment Company Act would be unenforceable by any party to the contract unless a court were to find that under the circumstances enforcement would produce a more equitable result than nonenforcement and would not be inconsistent with the purposes of the Investment Company Act. Should we be subjected to any or all of the foregoing, our business would be materially and adversely affected.

Personnel and Business Continuity Risks

We rely on our management team and will require additional key personnel to grow our business, and the loss of key management members or key employees, or an inability to hire key personnel, could harm our business.
We believe our success has depended, and continues to depend, on the efforts and talents of our senior management, who have significant experience in the financial services and technology industries, are responsible for our core competencies and would be difficult to replace. Our future success depends on our continuing ability to attract, develop, motivate and retain highly qualified and skilled employees. Qualified individuals are usually in high demand even in an uncertain economy, and we may incur significant costs to attract and retain them. In addition, the loss of any of our senior management or key employees could materially adversely affect our ability to execute our business plan and strategy, and we may not be able to find adequate replacements on a timely basis, or at all, and our other employees may be required to take on additional responsibilities. Furthermore, many candidates evaluate year over year stock growth trends for a sense of the potential long-term value of their proposed stock awards. The volatility of the market price of our common stock could harm our ability to attract and retain talent. Our executive officers and other employees are at-will employees, which means they may terminate their employment relationship with us at any time, and their knowledge of our business and industry would be extremely difficult to replace. We cannot ensure that we will be able to retain the services of any members of our senior management or other key employees. If we do not succeed in attracting well-qualified employees or retaining and motivating existing employees, our business could be materially and adversely affected.
The job market and the optimization of our workforce creates a challenge and potential risk as we strive to attract and retain a highly skilled workforce.
Competition for certain of our employees, including highly skilled technology and product professionals responsible for the design, engineering and operation of systems, is competitive, which can present a risk as we compete for experienced candidates, especially if the competition is able to offer more attractive financial terms of employment. This risk extends to our current employee population. We also invest significant time and expense in engaging and developing our employees, which

76

SoFi Technologies, Inc.
TABLE OF CONTENTS

also increases their value to other companies that may seek to recruit them. Turnover can result in significant replacement costs and lost productivity.
In addition, from time to time, we implement organizational changes to pursue greater efficiency and realign our business and strategic priorities. For example, in the past, we laid off a relatively small number of employees even though we intend to continue to hire in other areas. As our organization continues to evolve, and we are required to implement and optimize our business and organizational structures, we may find it difficult to maintain the benefits of our corporate culture, including our ability to quickly develop and launch new and innovative products. This could negatively affect our business performance. See also “ We transitioned to a flexible-first workforce model, which could subject us to increased business continuity and cyber risks, as well as other operational challenges and risks that could significantly harm our business and operations ” for more information on the impact of a flexible workforce model on corporate culture and employee retention.
In addition, U.S. immigration policy has made it more difficult for qualified foreign nationals to obtain or maintain work visas under the H-1B classification. These H-1B visa limitations make it more difficult and/or more expensive for us to hire the skilled professionals we need to execute our growth strategy, especially engineering, data analytics and risk management personnel, and may adversely impact our business.
We transitioned to a flexible-first workforce model, which could subject us to increased business continuity and cyber risks, as well as other operational challenges and risks that could significantly harm our business and operations.
We offer most of our employees the choice of working full time in the office, a hybrid approach, or full-time remote. In 2023 we announced an increase in in-office collaboration for non-remote employees who are returning to the office for a specified number of days per month, varying by business team. This return to the office for non-remote employees is limited, and we expect many employees to continue to work remotely for a number of days per week. As a result, we expect to continue to be subject to the challenges and risks of having a remote workforce, as well as new challenges and risks from operating with a hybrid workforce. For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities. Such security systems may be less secure than those used in our offices, which have in the past and may continue to subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations. Additionally, employees who access company data and systems remotely may not have access to technology that is as robust as that in our offices, which could place additional pressure on our user infrastructure and third parties that are not easily mitigated. These risks include home internet availability affecting work continuity and efficiency, and additional dependencies on third-party communication tools, such as instant messaging and online meeting platforms. We may also be exposed to risks associated with the locations of remote employees, including compliance with local laws and regulations or exposure to compromised internet infrastructure. Allowing our employees to work remotely may create intellectual property risk if employees create intellectual property on our behalf while residing in a jurisdiction with unenforced or uncertain intellectual property laws. Further, if employees fail to inform us of changes in their work location, we may be exposed to additional risks without our knowledge. While most of our operations can be performed remotely and we believe have operated effectively, there is no guarantee that this will continue or that we will continue to be as effective while operating a flexible-first workforce model because our team is dispersed.
Additionally, operating our business with both remote and in-person workers, or workers who work in flexible locations and on flexible schedules, could have a negative impact on our corporate culture, decrease the ability of our workforce to collaborate and communicate effectively, decrease innovation and productivity, or negatively affect workforce morale. If we are unable to manage the cybersecurity and other risks of a flexible-first workforce model, and maintain our corporate culture and workforce morale, our business could be harmed or otherwise adversely impacted.
Our business is subject to the risks of natural disasters, power outages, telecommunications failures and similar events, including public health crises, and to interruptions by human-made problems such as terrorism, cyberattacks, and other actions, which may impact the demand for our products or our members’ ability to repay their loans.
Events beyond our control may damage our ability to maintain our platform and provide services to our members. Such events include, but are not limited to, hurricanes, earthquakes, fires, floods and other natural disasters, public health crises, power or other outages, telecommunications failures and similar events. Despite any precautions we may take, system interruptions and delays could occur if there is a natural disaster, if a third-party provider closes a facility we use without adequate notice for financial or other reasons, or if there are other unanticipated problems at our leased facilities. Because we rely heavily on our servers, computer and communications systems and the Internet to conduct our business and provide high-quality service to our members, disruptions could harm our ability to effectively run our business. Moreover, our members and customers face similar risks, which could directly or indirectly impact our business. We currently use AWS and would be unable to switch instantly to another system in the event of failure to access AWS. This means that an outage of AWS could result in our system being unavailable for a significant period of time. Terrorism, cyberattacks and other criminal, tortious or

77

SoFi Technologies, Inc.
TABLE OF CONTENTS

unintentional actions could also give rise to significant disruptions to our operations. In addition, the long-term effects of climate change on the global economy and our industry in particular are unclear, however we recognize that there are inherent climate-related risks wherever business is conducted. For example, our offices may be vulnerable to the adverse effects of climate change. We have large offices located in the San Francisco Bay Area, Salt Lake City, Utah, and Jacksonville, Florida, regions that are prone to events such as seismic activity and severe weather, that have experienced and may continue to experience, climate-related events and at an increasing rate. Examples include drought and water scarcity, hurricanes, warmer temperatures, wildfires and air quality impacts and power shut-offs associated with wildfire prevention and hurricanes. The increasing intensity of drought throughout California and Utah and annual periods of wildfire danger, and the increasing intensity of hurricanes in Florida, increase the probability of planned power outages. Although we maintain a disaster response plan and insurance, such events could disrupt our business, the business of our partners or third-party suppliers, and may cause us to experience losses and additional costs to maintain and resume operations. Our business interruption insurance may not be sufficient to compensate us for losses that may result from interruptions in our service as a result of system failures or other disruptions. Comparable natural and other risks may reduce demand for our products or cause our members to suffer significant losses and/or incur significant disruption in their respective operations, which may affect their ability to satisfy their obligations towards us. All of the foregoing could materially and adversely affect our business, results of operations and financial condition.
Employee misconduct, which can be difficult to detect and deter, could harm our reputation and subject us to significant legal liability.
We operate in an industry in which integrity and the confidence of our members is of critical importance. We are subject to, and have experienced, risks of errors and misconduct by our employees that could adversely affect our business, including:
• engaging in misrepresentation or fraudulent activities when marketing or performing online brokerage and other services to our members;
• improperly using or disclosing confidential information of our members, technology platform clients, or other parties;
• concealing unauthorized or unsuccessful activities; or
• otherwise not complying with applicable laws and regulations or our internal policies or procedures.
There have been numerous highly-publicized cases of fraud and other misconduct by financial services industry employees. The precautions that we take to detect and deter employee misconduct might not be effective. If any of our employees engage in illegal, improper, or suspicious activity or other misconduct, we could suffer serious harm to our reputation, financial condition, member relationships, and our ability to attract new members. We also could become subject to regulatory sanctions and significant legal liability, which could cause serious harm to our financial condition, reputation, member relationships and prospects of attracting additional members.

Risk Management and Financial Reporting Risks

If we fail to establish and maintain proper and effective internal control over financial reporting, our ability to produce accurate and timely financial statements could be impaired, investors may lose confidence in our financial reporting and the trading price of our common stock may decline.
Pursuant to Section 404 of the Sarbanes-Oxley Act, a report by management on internal control over financial reporting and an attestation of our independent registered public accounting firm are required. The rules governing the standards that must be met for management to assess internal control over financial reporting are complex and require significant documentation, testing and possible remediation. We are required, pursuant to Section 404 of the Sarbanes-Oxley Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for our annual reports on Form 10-K. This assessment must include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. Our independent registered public accounting firm must also attest to the effectiveness of our internal control over financial reporting in our annual reports on Form 10-K. We are required to disclose changes made in our internal controls and procedures on a quarterly basis. Failure to comply with the Sarbanes-Oxley Act could potentially subject us to sanctions or investigations by the SEC, the applicable stock exchange or other regulatory authorities, which would require additional financial and management resources.
The annual internal control assessment required by Section 404 of Sarbanes-Oxley has diverted, and may in the future divert, internal resources and we have and may experience higher operating expenses, higher independent auditor and consulting fees in the future. To comply with the Sarbanes-Oxley Act, the requirements of being a reporting company under the

78

SoFi Technologies, Inc.
TABLE OF CONTENTS

Exchange Act and any new or revised accounting rules in the future, as necessary, we have, and may in the future further, work to upgrade the Company’s legacy information technology systems; implement additional financial and management controls, reporting systems and procedures; and hire additional accounting and finance staff. If we are unable to hire the additional accounting and finance staff necessary to comply with these requirements, we may need to retain additional outside consultants. In addition, our current controls and any new controls that we develop may become inadequate because of poor design and changes in our business. For example, our continuing growth and expansion in globally dispersed markets, such as our acquisition of Technisys, has placed and may in the future place significant additional pressure on our system of internal control over financial reporting, as acquisition targets may not be in compliance with the provisions of the Sarbanes-Oxley Act. We do not conduct a formal evaluation of companies’ internal control over financial reporting prior to an acquisition. We may be required to hire additional staff and incur substantial costs to implement the necessary new internal controls at companies we acquire. Any failure to implement and maintain effective internal controls over financial reporting could adversely affect the results of assessments by our independent registered public accounting firm and their attestation reports. If we or, if required, our independent registered public accounting firm, are unable to conclude that our internal control over financial reporting is effective, investors may lose confidence in our financial reporting, which could negatively impact the price of our securities.
As a result of any material weakness, restatement, change in accounting, or other matters raised or that may in the future be raised by the SEC, we may face potential litigation or other disputes, which may include, among others, claims invoking the federal and state securities laws, contractual claims or other claims arising from the restatement and material weaknesses in our internal control over financial reporting and the preparation of our financial statements. We can provide no assurance that litigation or disputes will not arise in the future. Any such litigation or dispute related to our financial statements or internal controls, whether successful or not, could have a material adverse effect on our business, results of operations and financial condition.
We cannot assure you that there will not be additional material weaknesses in our internal control over financial reporting now or in the future. Any failure to maintain internal control over financial reporting could cause us to fail to timely detect errors and severely inhibit our ability to accurately report our financial condition, results of operations or cash flows. If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines that we have a material weakness in our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by Nasdaq, the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.
We adjust our total number of members in the event a member is removed in accordance with our terms of service, and our total member count in any one period may not yet reflect such adjustments.
We adjust our total number of members in the event a member is removed in accordance with our terms of service. This could occur for a variety of reasons—including fraud or pursuant to certain legal processes or if a member requests that we close their account in accordance with our terms of service—and, as our terms of service evolve together with our business practices, product offerings and applicable regulations, additional grounds for removing members from our total member count could occur. The determination that a member should be removed in accordance with our terms of service is subject to an evaluation process, following the completion, and based on the results, of which, relevant members and their associated products are removed from our total member count. However, depending on the length of the evaluation process, that removal may not take place in the same period in which the member was added to our member count or the same period in which the circumstances leading to their removal occurred. For this reason, our total member count in any one period may not yet reflect such adjustments. In any given period, we estimate that up to 10% of our members may be under evaluation for removal in accordance with our terms of service; however, we cannot assure you that this percentage in any period will not be more significant and have an adverse impact on our stock price or results of operations.
Our reported financial results may be adversely affected by changes in accounting principles generally accepted in the United States.
Generally accepted accounting principles in the United States are subject to interpretation by the Financial Accounting Standards Board, the American Institute of Certified Public Accountants, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.

79

SoFi Technologies, Inc.
TABLE OF CONTENTS