Dave (DAVE) Risk Analysis

Our success is dependent, in part, upon protecting our proprietary technology and rights. We rely on a combination of copyrights, trademarks, trade secret laws, and contractual provisions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. Any of our trademarks or other intellectual property rights may be challenged or circumvented by others or invalidated through administrative process or litigation. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and services that compete with ours. No assurance can be given that the contractual agreements we enter into to establish and protect our proprietary rights will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our platform.

In the normal course of business, we collect, process, use and retain sensitive and confidential information regarding our Members and prospective Members, including data provided by and related to Members and their transactions, as well as other data of the counterparties to their payments. We also have arrangements in place with certain third-party service providers with which we share consumer information for servicing purposes. Information security risks in the financial services industry continue to increase generally, in part because of new technologies, the use of the Internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized criminals, perpetrators of fraud, hackers, terrorists and other malicious third parties. In addition to cyberattacks and other security breaches involving the theft of sensitive and confidential information, hackers, terrorists, sophisticated nation-state and nation-state supported actors and other malicious third parties recently have engaged in attacks that are designed to disrupt key business services, such as consumer-facing applications and websites. These cybersecurity challenges, including threats to our own IT infrastructure or that of our third-party providers, may take a variety of forms ranging from stolen bank accounts, email compromise, user fraud, account takeover, check fraud and cybersecurity attacks (including ransomware, unauthorized encryption, denial-of-service attacks, social engineering, unauthorized access, spam and other attacks) to "mega breaches" targeted against cloud-based services and other hosted software, which could be initiated by individual or groups of hackers or sophisticated cyber criminals. A cybersecurity incident or breach could result in disclosure of confidential information or intellectual property, or cause service interruptions and compromised data. The techniques used to obtain unauthorized access to or sabotage systems they change frequently and often are not detected until after an incident has occurred, so we may be unable to anticipate or prevent techniques used in the future. Our information technology and infrastructure, as well as those of our third-party service providers, have experienced breaches and may be subject or vulnerable in the future to breaches or attacks. For example, a third-party breach at our bank partner, Evolve, resulted in improper disclosure of certain of certain of our Members' information, including their names, Social Security numbers, partner bank account numbers, date of birth, and contact information. Any future improper disclosure of our own confidential business information or the information of our Members could materially and adversely affect our business. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security, regardless of how it occurs or the extent of the breach, could have a significant impact on our reputation as a trusted brand, cause us to lose existing partners or Members, prevent us from obtaining new partners and Members, require us to expend significant funds to remedy problems caused by breaches and implement measures to prevent further breaches, and expose us to legal risk and potential liability including from governmental or regulatory investigations, class action litigation and other lawsuits. If sensitive information is lost or improperly disclosed through a data breach or otherwise or threatened to be disclosed, our partners and Members could lose confidence in the security of our systems, products and services, we could have difficulty obtaining new partners and Members, we could incur significant costs to remedy breaches and implement measures to prevent further breaches, and we could be exposed to legal risk and potential liability and penalties, including from governmental or regulatory investigations, class action litigation and other lawsuits, all of which could adversely affect our reputation and our operating results. Any actual or perceived security breach at a company providing services to us or our Members could have similar effects. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data. In addition, our agreements with certain partners and service providers may require us to notify them in the event of certain types of security breaches. Such disclosures are costly, could lead to negative publicity, may cause our Members to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach. A security breach of any of our vendors that processes personally identifiable information of our Members may pose similar risks. In May 2020, an unauthorized third party attempted to gain access to Dave Member accounts and was able to access Member profiles and Members' partial or incomplete bank account information. We did not uncover any evidence that the attacker was able to take any actions with respect to the data other than gaining read access to it, nor do we believe any unauthorized transactions were made or ExtraCash overdrafts requested on our platform. We provided notice to relevant parties as required under applicable law and agreements and took steps to set up alerts to detect abnormal request volumes and introduced rate limiting at the IP address level. In addition, in June 2020, we were notified of an unauthorized third-party breach of our Dave database. The third party was able to gain access to Dave's system by breaching the system of one of Dave's third-party service providers. The attacker was able to download a large data set, including encrypted social security numbers for some Members; however, there was no evidence that unauthorized transactions were made or ExtraCash overdrafts requested on our platform, nor do we believe that the third party gained access to decryption keys or otherwise was able to decrypt the encrypted information. The May 2020 and June 2020 incidents are collectively referred to herein as the "2020 Incidents." We took remedial measures, including the engagement of an outside security consultant to monitor for ongoing dark web activity and to conduct a security audit and incident investigation, and notified relevant parties as required under applicable law and agreements. As a result of the 2020 Incidents, we settled a purported class action in California for approximately $3.1 million and we settled individual claims outside of California for approximately $4.4 million. In addition, in 2024, our bank partner, Evolve, experienced a data breach that resulted in improper disclosure of certain of our Members' information, including their names, Social Security numbers, partner bank account numbers, date of birth, and contact information. As we have increased our Member base and our brand has become more widely known and recognized, third parties may continue to seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our Members' data. If our banking partner or other strategic partners were to conclude that our systems and security policies and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business could be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of non-public personal information of our Members that we store, we could be liable to the partner for their losses and related expenses. Additionally, as computer malware, viruses, and computer hacking, fraudulent use attempts, and phishing attacks have become more prevalent, we, and third parties upon which we rely, face increased risk in maintaining the performance, reliability, security, and availability of our solutions and related services and technical infrastructure to the satisfaction of our Members. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security breaches related to our network infrastructure or information technology systems or to computer hardware we lease from third parties, could, among other things, harm our reputation and our ability to retain existing Members and attract new Members. Our insurance may be insufficient or may not cover all liabilities incurred by cybersecurity incidents. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

The industries in which we compete are highly competitive and subject to rapid and significant changes. We compete against companies and financial institutions across the retail banking, financial services, consumer technology and financial technology services industries, as well as other nonbank lenders serving credit-challenged consumers, including online marketplace lenders, check cashers, point-of-sale lenders and payday lenders. We may compete with others in the market who may in the future provide offerings similar to ours, particularly companies who may provide money management, lending and other services though a platform similar to our platform. These and other competitors in the banking and financial technology industries are introducing innovative products and services that may compete with ours. We expect that this competition will continue as banking and financial technology industries continue to evolve, particularly if non-traditional non-recourse advance providers and other parties gain greater market share in these industries or if changes in financial services regulation enable new competitors to enter the sector or new means of offering products and services that compete with ours. For example, some earned wage access providers with which Dave competes are evaluating whether to adopt new business models, such as through providing overdraft services through a partner bank or extending a line of credit. If we are unable to differentiate our products and platform from and successfully compete with those of our competitors, or if our competitors adopt business models that more closely resemble our own, we may lose our competitive advantage and our business, results of operations and financial condition may be materially and adversely affected. Many existing and potential competitors are entities substantially larger in size and more established, including with greater resources, highly diversified revenues and significantly more brand awareness than ours. As such, many of our competitors can leverage their size, robust networks, financial wherewithal, brand awareness, pricing power and technological assets to compete with us. To the extent new entrants gain market share, the purchase and use of our products and services would decline. If price competition materially intensifies, we may have to decrease the prices of our products and services, which would likely adversely affect the results of operations. Our long-term success depends on our ability to compete effectively against existing and potential competitors that seek to provide banking and financial technology products and services. If we fail to compete effectively against these competitors, our revenues, results of operations, prospects for future growth and overall business will be materially and adversely affected.

Recent macroeconomic factors, such as elevated interest rates, global events and market volatility, may cause the economy to enter into a period of slower economic growth or a recession, the length and severity of which cannot be predicted. Such uncertainty and negative trends in general economic conditions can have a significant negative impact on our ability to generate adequate revenue and to absorb expected and unexpected losses. Many factors, including factors that are beyond our control, may result in higher default rates by our Members and non-payment by our technology platform clients, a decline in the demand for our products, and potentially impact our ability to make accurate credit assessments, lending decisions or technology platform client selections. Any of these factors could have a detrimental impact on our financial performance and liquidity. The longevity and severity of a downturn or recession will also place pressure on our business and strategy. The timing and extent of a downturn may require us to change, postpone or cancel our strategic initiatives or growth plans to pursue shorter-term sustainability. The longer and more severe an economic downturn, the greater the potential adverse impact on us. There can be no assurance that economic conditions will be favorable for our business, that customer interest in our platform as a service will remain at current levels, or that default rates by Members will not increase. These impacts could limit our access to capital and negatively impact our profitability.

Negative publicity about us or our industry, even if inaccurate, could adversely affect our reputation and the confidence in, and use of our platform, potentially harming our reputation and causing disruptions to our platform. Such negative publicity could involve the: transparency, fairness, our Members' experience, quality, and reliability of our platform or consumer fintech platforms in general, the effectiveness of our risk models, our ability to effectively manage and resolve complaints, our privacy and security practices, litigation, regulatory activity, misconduct by our employees, funding sources, bank partners and structure of our bank partner products, service providers, or others in our industry, the experience of consumers with our platform or services. Any such reputational harm could further affect the behavior of consumers, including their willingness to use ExtraCash, deposit accounts, and other products and services facilitated through our platform. As a result, our business, results of operations, financial condition, and future prospects would be materially and adversely affected.

Our business, the consumer financial services industry, and our partners' businesses are sensitive to macroeconomic conditions. Economic factors such as interest rates, changes in monetary and related policies, market volatility, inflationary conditions, student loan obligations, consumer confidence, and unemployment rates are among the most significant factors that impact consumer spending behavior. Weak economic conditions or a significant deterioration in economic conditions, including the current inflationary environment and possibility of a recession, reduce the amount of disposable income consumers have, which in turn reduces consumer spending and the willingness of qualified consumers to use ExtraCash. Such conditions are also likely to affect the ability and willingness of consumers to pay amounts owed under ExtraCash overdrafts facilitated through our platform, each of which would have an adverse effect on our business, results of operations, financial condition, and future prospects. In addition, if a commercial partner becomes subject to a voluntary or involuntary bankruptcy proceeding, receivership or liquidation (or if there is a perception that it may become subject to such an action), consumers may have less incentive to pay their outstanding balances on ExtraCash overdrafts facilitated through our platform, which could result in higher charge-off rates than anticipated. Moreover, if the financial condition of a commercial partner deteriorates significantly or a commercial partner becomes subject to a bankruptcy proceeding, we may not be able to recover amounts due to us from the commercial partner.

The current U.S. administration has signaled the potential imposition of tariffs and retaliatory tariffs against U.S. trading partners. Potential tariffs and trade restrictions may cause the prices of products to increase, which could reduce our Members' disposable income, and adversely impact their spending, willingness to use ExtraCash, or ability to repay ExtraCash. This, in turn, could adversely affect our financial condition and results of operations. The current U.S. administration is also proposing and seeking to implement significant changes to the size and scope of the federal government. These changes may include reductions to government funding of various programs and agencies, alteration of the payment systems it uses, changes in policy direction, reduction and possible elimination of various federal agencies and bureaus and reduction of the overall federal government workforce. These changes, which may have a positive impact by reducing the overall federal deficit and reducing regulatory burden, may also have potential negative impacts, including impacts on the economy as a whole or different regions or segments of the economy. Accordingly, it is possible that such comprehensive changes may be materially adverse to our Members, business, financial condition and results of operation.

Natural disasters, pandemics, other catastrophic events or man-made disasters may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in Los Angeles, California, and our data centers are located in the Midwest. The west coast of the United States contains active earthquake zones and the greater Los Angeles area has recently experienced major fires, including the significant damage and lasting effects of the January 2025 wildfires, and may experience major fires in the future. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, political instability, civil unrest, war, or terrorist attack, we may be unable to continue our operations and may experience system interruptions, reputational harm, delays in our application development, lengthy interruptions in the availability of our products and services, breaches of data security, and loss of critical data, all of which could harm our business, operating results, and financial condition. In addition, the insurance we maintain may not cover or may be insufficient to cover our losses resulting from disasters, or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.