Robinhood Markets (HOOD) Risk Analysis

We are subject to a wide variety of local, state, federal, and international laws, regulations, licensing schemes, and industry standards in the United States, the UK, the EU and in other countries and regions in which we operate. These laws, regulations, and standards govern numerous areas that are important to our business, and include, or might in the future include, those relating to all aspects of the securities industry, financial services, money transmission, the origination, marketing, servicing, and collection of consumer debt, foreign exchange, payments services and products (such as payment processing, settlement services, and credit cards), cryptocurrency, derivatives, trading in shares and fractional shares, fraud detection, consumer protection, anti-money laundering, escheatment, sanctions regimes and export controls, data privacy, data protection, data security, as well as climate risk and environmental impact, including with respect to disclosure of greenhouse gas emissions and other metrics related to climate change. The substantial costs and uncertainties related to complying with these laws and regulations continue to increase, and our introduction of new products or services, expansion of our business into new jurisdictions or subindustries, acquisitions of other businesses that operate in similar regulated spaces, or other actions that we may take might subject us to additional laws, regulations, or other government or regulatory scrutiny. For example, after launching Sherwood Media, our media subsidiary dedicated to providing news and information about the markets, economics, business, technology, and the culture of money), we received inquiries from FINRA regarding Sherwood Media’s relationship to RHF. In addition, after announcing in March 2024 the launch of the Robinhood Gold Card, which is currently offered via invitation only through Robinhood Credit exclusively to Gold Subscribers and provides rewards via the Robinhood Gold Credit Card Rewards Program, we received requests for information from the Massachusetts Securities Division (“MSD”) related to the Robinhood Gold subscription service and the Robinhood Gold Card. RHF also received requests for information from the MSD after we began to offer certain event contracts in October 2024. Regulations are intended to ensure the integrity of financial markets, to maintain appropriate capitalization of broker-dealers and other financial services companies, and to protect customers and their assets. These regulations could limit our business activities through capital, customer protection, and market conduct requirements, as well as restrictions on the activities that we are authorized to conduct. We operate in a highly regulated industry and, despite our efforts to comply with applicable legal requirements, like all companies in our industry, we must adapt to frequent changes in laws and regulations, and face complexity in interpreting and applying evolving laws and regulations to our business, heightened scrutiny of the conduct of financial services firms and increasing penalties for violations of applicable laws and regulations. We might fail to establish and enforce procedures that comply with applicable legal requirements and regulations. We might be adversely affected by new laws or regulations, changes in the interpretation of existing laws or regulations, or more rigorous enforcement. For instance, since we began to offer event contracts, the CFTC has been in the process of appealing the U.S. District Court for the District of Columbia’s decision in KalshiEx LLC v. Commodity Futures Trading Commission, and should the CFTC succeed on appeal, we may not be able to continue to offer certain event contracts and potentially could be subject to adverse litigation and regulatory actions for doing so. In addition, the CFTC has proposed a rule amendment that has not been finalized—if adopted by the CFTC as proposed, we would likely be prohibited from offering election event contracts (similar to the ones we offered in November 2024) in the future. Our ability to offer certain products may also be impacted by actions taken by government regulators. There is a risk that regulators could request or require us to cease offering specific products or services. Such regulatory actions could lead to the suspension or termination of product offerings, which may result in increased compliance costs, financial losses and negative publicity. For example, in February 2025, the CFTC formally requested that RHD “not permit customers to access” sports event contracts “until staff can complete a review,” leading us to suspend the rollout of this product. We also might be adversely affected by other regulatory changes related to our obligations with regard to suitability of financial products, supervision, sales practices, application of fiduciary or best interest standards (including the interpretation of what constitutes an “investment recommendation” for the purposes of the SEC’s “Regulation Best Interest” and state securities laws) and best execution in the context of our business and market structure, any of which could limit our business, increase our costs and damage our reputation. Broker-Dealer and FCM Regulations As broker-dealers, our subsidiaries RHF and RHS are subject to extensive regulation by federal and state regulators and SROs, and are subject to laws and regulations covering all aspects of the securities industry. Federal and state regulators and SROs, including the SEC and FINRA, can, among other things, investigate, censure or fine us, issue cease-and-desist orders or otherwise restrict our operations, require changes to our business practices, products or services, limit our acquisition activities or suspend or expel a broker-dealer or any of its officers or employees. Our subsidiary RHD, a registered FCM with the CFTC, is also subject to extensive regulation by federal and state regulators and SROs related to offering our customers Futures products. Similarly, state attorneys general and other state regulators, including state securities and financial services regulators, can bring legal actions on behalf of the citizens of their states to assure compliance with state laws. In addition, criminal authorities such as state attorneys general or the DOJ may institute civil or criminal proceedings against us for violating applicable laws, rules, or regulations. Money-Transmitter Regulation As money transmitters, certain of our subsidiaries are subject to regulation, primarily at the state level. We are also subject to regulation by the CFPB. We have obtained or are in the process of obtaining licenses to operate as a money transmitter (or as another type of regulated financial services institution, as applicable) in the United States and in the states where this is required. As a licensed money transmitter, we are subject to obligations and restrictions with respect to the movement of customer funds, reporting requirements, bonding requirements, and inspection by state regulatory agencies concerning those aspects of our business considered money transmission. Evaluation of our compliance efforts, as well as the questions of whether and to what extent our products and services are considered money transmission, are matters of regulatory interpretation and could change over time. There are substantial costs and potential product and operational changes involved in maintaining and renewing these licenses, certifications, and approvals, and we could be subject to fines, other enforcement actions, and litigation if we are found to violate any of these requirements. There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any such licenses, renewals, certifications, and approvals in any jurisdictions. In certain markets, we might rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators might use their authority over such local partners to prohibit, restrict, or limit us from doing business. The need to obtain or maintain these licenses, certifications, or other regulatory approvals could impose substantial additional costs, delay or preclude planned transactions, product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products, and services, or prevent us from providing our products or services in a given market.

The highly automated nature of, and liquidity offered by, our spending and payments services to move money make us and our customers a target for illegal or improper uses, including scams and fraud directed at our stored value Spending Account, Robinhood Cash Card, and Robinhood Credit customers, money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted or trademarked goods (in particular, digital goods), bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or ponzi schemes, or the facilitation of other illegal or improper activity. Moreover, certain activity that is legal in one jurisdiction might be illegal in another jurisdiction, and a customer might be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us. Owners of intellectual property rights or government authorities might seek to bring legal action against providers of payments solutions, including Robinhood, that are peripherally involved in the sale of infringing or allegedly infringing items. While we invest in measures intended to prevent and detect illegal activities with respect to our spending and payments services, these measures require continuous improvement and might not be effective in detecting and preventing illegal activity or improper uses. Any illegal or improper uses of our spending and payments services by our users might subject us to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business. For example, government enforcement or regulatory authorities could seek to impose additional restrictions or liability on us arising from the use of our spending and payments services for illegal or improper activity, and our failure to detect or prevent such use. Illegitimate transactions can also prevent us from satisfying our contractual obligations to our third-party partners, which might cause us to be in breach of our obligations.

We are, and may in the future become, subject to complex and evolving U.S. and foreign tax laws and regulations, which might in the future make changes to corporate income tax rates, the treatment of foreign earnings, or other income tax laws that could have an adverse impact on our business, result of operations, financial condition and cash flows. Our determination of our tax liability is subject to review by applicable tax authorities. The determination of our tax liabilities requires significant judgment and, in the ordinary course of business, there are transactions and calculations where the ultimate tax determination is complex and uncertain. Although we believe our determinations are reasonable, the ultimate amount of our tax obligations owed might differ from the amounts recorded in our financial statements in the event of a review by applicable tax authorities and any such difference could have an adverse effect on our results of operations. Tax authorities might also disagree with certain positions we have taken or might take in the future, which could subject us to additional tax liabilities. Our corporate structure and associated transfer pricing policies also contemplate future growth in international markets, and consider the functions, risks, and assets of various entities involved in intercompany transactions. The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for valuing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, from time to time, proposals are introduced in the U.S. Congress and state legislatures, as well as by foreign governments, to impose new taxes on a broad range of financial transactions, including transactions that occur on our platforms, such as the buying and selling of stocks, derivative transactions, and cryptocurrencies. If enacted, such financial transaction taxes could increase the cost to customers of investing or trading on our platforms and reduce or adversely affect U.S. market conditions and liquidity, general levels of interest in investing, and the volume of trades and other transactions from which we derive transaction-based revenues. Any financial transaction tax implemented in any jurisdiction in which we operate could materially and adversely affect our business, financial condition, or results of operations, and as a retail brokerage we could be impacted to a greater degree than other market participants. We also are subject to non-income taxes, such as payroll, sales, use, value-added, net worth, excise, goods and services, and property taxes in the United States and various foreign jurisdictions. Specifically, we might be subject to ''digital service taxes'' or new allocations of tax as a result of increasing efforts by certain jurisdictions to tax cross border activities that might not have been subject to tax under existing international tax principles. Companies such as ours could be adversely impacted by such taxes.

Our success and ability to compete depend in part upon our ability to obtain, maintain, protect, defend and enforce our intellectual property rights and technology. The steps we take to protect our intellectual property rights might not be sufficient to effectively prevent third parties from infringing, misappropriating, diluting, or otherwise violating our intellectual property rights or to prevent unauthorized disclosure or unauthorized use of our trade secrets or other confidential information. We make business decisions about when to seek patent protection for a particular technology, obtain trademark or copyright protection and when to rely upon trade secret protection, and the approach we select might ultimately prove to be inadequate. We will not be able to protect our intellectual property rights, however, if we do not detect unauthorized use of our intellectual property rights. We also might fail to maintain or be unable to obtain adequate protections for some of our intellectual property rights in the United States and some non-U.S. countries, and our intellectual property rights might not receive the same degree of protection in non-U.S. countries as they would in the United States because of the differences in non-U.S. patent, trademark, copyright, and other laws concerning intellectual property and proprietary rights. In addition, if we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Our trademarks might also be opposed, contested, circumvented or found to be unenforceable, weak or invalid, and we might not be able to prevent third parties from infringing or otherwise violating them or using similar marks in a manner that causes confusion or dilutes the value or strength of our brand. In addition to registered intellectual property rights, we rely on non-registered proprietary information and technology, such as trade secrets, confidential information and know-how. We attempt to protect our intellectual property, technology, and confidential information by requiring our employees, contractors, consultants, corporate collaborators, advisors and other third parties who develop intellectual property on our behalf to enter into agreements relating to confidentiality and invention assignments, and third parties we share information with to enter into nondisclosure and confidentiality agreements. However, we might not have any such agreements in place with some of the parties who have developed intellectual property on our behalf and/or with some of the parties that have or might have had access to our confidential information, know-how, and trade secrets. Even where these agreements are in place, they might be insufficient or breached, or might not effectively prevent unauthorized access to or unauthorized use, disclosure, misappropriation, or reverse engineering of our confidential information, intellectual property, or technology. Moreover, these agreements might not provide an adequate remedy for breaches or in the event of unauthorized use or disclosure of our confidential information or technology, or infringement of our intellectual property. If any of our trade secrets were to be lawfully obtained or independently developed by a competitor or other third party, we would have no right to prevent them from using that technology or information to compete with us, and our competitive position could be materially and adversely harmed. The loss of trade secret protection could make it easier for third parties to compete with our products and services by copying functionality. Additionally, individuals not subject to invention assignment agreements might make adverse ownership claims to our current and future intellectual property, and, to the extent that our employees, independent contractors, or other third parties with whom we do business use intellectual property owned by others in their work for us, disputes might arise as to the rights in related or resulting know-how and inventions. In addition, we might need to expend significant resources to apply for, maintain, enforce and monitor our intellectual property rights and such efforts might be ineffective and could result in substantial costs and diversion of resources. An adverse outcome in any such litigation or proceedings might expose us to a loss of our competitive position, significant liabilities, and damage to our brand, or require us to seek licenses that might not be available on commercially acceptable terms, if at all.

Our systems and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity issues. We, like other financial technology organizations, routinely are subject to cybersecurity threats and our technologies, systems, and networks have been and might in the future be subject to attempted cybersecurity attacks. Such issues are increasing in frequency and evolving in nature, including employee and contractor theft or misuse, denial-of-service attacks, and sophisticated nation-state and nation-state-supported actors engaging in attacks. The operation of our platforms involves the use, collection, storage, sharing, disclosure, transfer, and other processing of customer information, including personal data. Security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, litigation, and remediation costs, as well as reputational harm. As the breadth and complexity of the technologies we use and the software and platforms we develop continue to grow, the potential risk of security breaches and cybersecurity attacks increases. Cybersecurity attacks and other malicious internet-based activity continue to increase and financial technology platform providers have been and expect to continue to be targeted. In light of media attention, we might be a particularly attractive target of attacks seeking to access customer data or assets and have experienced negative publicity in connection with previous security incidents and might in the future experience similar adverse effects relating to real or perceived security incidents, whether or not related to the security of our platforms or systems. We have also received customer complaints and been subject to litigation and regulatory inquiries, examinations, enforcement actions, and investigations by various state and federal regulatory bodies, including the SEC, FINRA, and certain state regulators, including the NYDFS and the New York Attorney General, related to these events. The increasing sophistication and resources of cyber criminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security. Additionally, there is an increased risk that we might experience cybersecurity-related incidents as a result of any of our employees, service providers, or other third-parties working remotely on less secure systems and environments. While we take significant efforts to protect our systems and data, including establishing internal processes and implementing technological measures designed to provide multiple layers of security, our safety and security measures might be insufficient to prevent damage to, or interruption or breach of, our information systems, data (including personal data), and operations, such as the November 2021 Data Security Incident. Furthermore, to the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees might increase. Third-party risks might include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws or security measures might be inadequate. Our ability to monitor, and our resources to optimize integration with, third-party service providers’ data security practices are also limited. These third-party risks might be exacerbated as our resources are spread across multiple public cloud service providers. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, such agreements might not prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of, or modification of data (including personal data) and/or might not enable us to obtain adequate (or any) reimbursement from our third-party service providers in the event we should suffer any such incidents. For example, in late October 2024, a cyberattack occurred on our Newsroom in which a cyberattacker gained access to our Newsroom website, control of which is subcontracted to a third party vendor, for a limited number of hours. The cyberattack did not result in any unauthorized access of customer information. In addition, in December 2024, a cyberattack occurred at Cyberhaven, a data protection company we utilize as a third-party vendor, creating the potential for attackers to steal sensitive data through a malicious version of a Google Chrome extension. Although we do not believe at this time that this third party vulnerability impacted us, the attack highlights the growing risk from cybersecurity threats against third-party service providers. Due to applicable laws and regulations or contractual obligations, we could be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our third-party solutions. Additionally, we could also be exposed to information security vulnerabilities or failures at third parties’ common suppliers or vendors (known as “fourth parties”) that could also impact the security of our data, and we may not be able to effectively directly monitor or mitigate such fourth-party risks, in particular as such risks relate to the use of common suppliers or vendors by the third parties that perform functions and services for us and our limited ability to assess the fourth party’s operational controls. A core aspect of our business is the reliability and security of our platforms. Any unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of or modification of data, including personal data, cybersecurity breach or other security incident that we, our customers or our third-party or fourth-party service providers experience or the perception that one has occurred or might occur, could harm our reputation, reduce the demand for our products and services and disrupt normal business operations. In addition, it might require us to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating, remediating, or correcting the breach and any security vulnerabilities, defending against and resolving legal and regulatory claims, and preventing future security breaches and incidents, all of which could expose us to uninsured liability, increase our risk of regulatory scrutiny, expose us to legal liabilities, including litigation, regulatory enforcement, indemnity obligations, or damages for contract breach, divert resources and the attention of our management and key personnel away from our business operations, and cause us to incur significant costs, any of which could materially adversely affect our business, financial condition, and results of operations. Moreover, our efforts to improve security and protect data from compromise might identify previously undiscovered security breaches. There could be public announcements regarding any security incidents and any steps we take to respond to or remediate such incidents, and if securities analysts or investors perceive these announcements to be negative, it could have an adverse effect on the trading price of our Class A common stock. While we maintain cybersecurity insurance, our coverage may be insufficient to cover all liabilities resulting from a cybersecurity incident. We cannot be certain that our insurance coverage will be adequate to address the results of regulatory or civil investigations or any liabilities resulting from a cybersecurity incident, that adequate insurance will be available to us on economically reasonable terms, or that our insurer will cover all cybersecurity incident-related claims. The successful assertion of one or more significant claims against us or changes in our cybersecurity insurance coverage, premiums, or deductibles may adversely affect our reputation, business, financial condition or results of operations.

We currently use machine learning and AI to improve our products and processes in certain circumstances, such as to increase the efficiency of our in-app chat support, customer support workflows, fraud detection systems, and software coding optimization, as well as to improve the customer experience in our newsfeed. This is also via our acquisition of Pluto Capital, an AI powered investment research platform, and we have plans to continue to expand our use of AI in the future. Our research and development of such technology also remains ongoing. As with many new and emerging technologies, AI presents numerous risks and challenges that could adversely affect our business. If we fail to keep pace with rapidly evolving AI technological developments, especially in the financial technology sector, our competitive position and business results may suffer. At the same time, use of AI has recently become the source of significant media attention and political debate. The introduction and use of AI technologies, particularly generative AI, into new or existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. For example, AI technologies can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could negatively impact our customers, harm our reputation and business, and expose us to liability. Laws, regulations or industry standards that develop in response to the use of AI may be burdensome or may restrict our ability to use, develop, or deploy AI, particularly generative AI technologies, in our products or processes, or our efforts to expand our business. For example, EU’s AI Act, which became effective on August 1, 2024, governs the development, marketing and use of AI in the EU and could impose significant additional costs on us to comply or significant fines for failing to comply. We also use AI technologies from third parties, which may include open source software. If we are unable to maintain rights to use these AI technologies on commercially reasonable terms, we may be forced to acquire or develop alternate AI technologies, which may limit or delay our ability to provide competitive offerings and may increase our costs. These AI technologies also may incorporate data from third-party sources, which may expose us to risks associated with data rights and protection. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including with respect to intellectual property ownership and license rights, cybersecurity, and data protection laws, among others, and has not yet been fully addressed by courts or regulators. The use, development, or adoption of AI technologies into our products may result in exposure to claims by third parties of copyright infringement or other intellectual property misappropriation, which may require us to pay compensation or license fees to third parties. The evolving legal, regulatory and compliance framework for AI technologies may also impact our ability to protect our own data and intellectual property against infringing use.

We have experienced customer growth in recent years, including a significant fraction of new customers, often more than 50%, who have told us that Robinhood is their first brokerage account. Our business and revenue growth depends on our efforts to attract new customers, retain existing customers, and increase the amount that our customers use our products and services (including premium services, such as Robinhood Gold). It is particularly important that we retain and engage our most active brokerage customers, who account for a disproportionately large percentage of our brokerage trading volumes. Any erosion of this active customer base would have a disproportionately large negative impact on our revenues, which could cause the trading price of our Class A common stock to decline significantly. Our efforts to attract and retain customers might fail due to a number of factors, including our customers losing confidence in us or preferring a competitor’s offerings. Additional factors that could lead to a decline in our number of customers or their usage of our products and services or that could prevent us from increasing our number of customers include: •a decline in our brand and reputation; •increased pricing for our products and services; •a shift in pricing models, including allowing customers to choose a fee-based model for cryptocurrency orders; •ineffective marketing efforts or a reduction in marketing activity; •certain of our customers, due to being new and inexperienced, might be less loyal to our product or less likely to maintain historical trading patterns and interest in investing; •a broad decline in the equity or other financial markets, which could result in many of these investors feeling discouraged and exiting the markets altogether (such as the bear markets that developed for equities and crypto in the second quarter of 2022 and continued into 2023 (the “2022 Bear Markets”)); •rising inflation resulting in less disposable income for our customers to invest; •our customers experiencing difficulties using the Robinhood app as intended, due to any number of reasons such as design errors, service outages, or trading restrictions imposed by us; •our customers experiencing security or data breaches, account intrusions, or other unauthorized access; our failure to provide adequate customer service; •customer resistance to and non-acceptance of cryptocurrencies; and •customer dissatisfaction with the limited number of cryptocurrencies available on our platforms or with our ceasing support for cryptocurrencies on our RHC platform that the SEC or a court has asserted or determined are securities or our proactively removing certain cryptocurrencies from our RHC platform because they share similarities with such cryptocurrencies. Our customers may choose to cease using our platforms, products, and services at any time, and may choose to transfer their accounts to another broker-dealer. For example, during the first quarter of 2021 many customers became upset by our imposition of the Early 2021 Trading Restrictions and we saw an increase in customers choosing to transfer their accounts to other broker-dealers.

Additionally, any negative publicity surrounding PFOF or Transaction Rebate practices generally, or our implementation of these practices, could harm our brand and reputation. For example, as a result of the Early 2021 Trading Restrictions (as defined in Note 16 - Commitments & Contingencies to our consolidated financial statements in this Annual Report), we faced allegations that our decision to temporarily prevent our customers from purchasing specified securities was influenced by our relationship with certain market makers. Furthermore, as registered broker-dealers, market makers must comply with rules and regulations that are generally intended to prohibit them from taking advantage of information they obtain while executing orders (e.g., through the prohibition on “front running”). Market makers also have a duty to seek “best execution” of customers’ equity and option orders we send to them. If the market makers we use to execute our customer’s equity and option trades were to violate such rules and regulations and use this data for their own benefit in violation of applicable rules and regulations, it could result in negative publicity for us by association. Developments in any proposals related to the regulation of PFOF or market structure design have generated and might continue to generate negative publicity associated with PFOF. For example, the intra-day trading price of our Class A common stock fell as much as 5.3% on December 14, 2022, the day the December 2022 Rule Proposals were announced. Additionally, if our customers or potential customers believe that they might get better execution quality (including better price improvement) directly from stock exchanges or from our competitors that have different execution arrangements, or if our customers perceive our PFOF practices to create a conflict of interest between us and them, or if they begin to disfavor the specific market markers with which we do business due to any negative media attention, they might come to have an adverse view of our business model and might decide to limit or cease the use of our platforms. Some customers might prefer to invest through our competitors that do not engage in PFOF or Transaction Rebate practices or engage in them differently than do we. Any such loss of customer engagement as a result of any negative publicity associated with PFOF or Transaction Rebate practices could adversely affect our business, financial condition, and results of operations. RHC is in the process of allowing customers to choose a fee-based model in lieu of our current liquidity provider rebate-based model (under which RHC receives payments akin to PFOF from liquidity providers) for cryptocurrency orders. This shift may lead to negative publicity due to potential differences in total costs for customers under the two models. Depending on the nature of these cost differences, concerns might arise about (i) the use of PFOF with respect to other asset classes like equities and options and/or (ii) the replacement of liquidity provider rebates by customer fees for orders in cryptocurrency routed for execution via exchanges. Any negative publicity associated with adopting this model may have an adverse impact on our business, financial condition and results of operations.

Our future success depends, in part, on our ability to continue to identify, attract, develop, integrate and retain qualified and highly skilled personnel. In particular, our CEO, Vladimir Tenev, has been critical to the development and execution of our business, vision, and strategic direction. In addition, we have heavily relied, and expect we will continue to heavily rely, on the services and performance of our senior management team, which provides leadership, contributes to the core areas of our business and helps us to efficiently execute our business. Although we have entered into employment offer letters with some of our key personnel, most of these agreements have no specific duration and are terminable by either party at-will and our senior management team has experienced recent changes. We do not maintain key person life insurance policies on any of our employees. We also might not be successful in attracting, integrating or retaining qualified personnel to fulfill our current or future needs. In particular, there continues to be particularly high competition in the San Francisco Bay Area for software engineers, computer scientists and other technical personnel. Given our heavy emphasis on SBC, the performance of our stock price has in the past had, and could continue to have, a significant impact on our ability to recruit, retain, and motivate highly skilled personnel. Additionally, our working model may negatively impact our ability to retain and recruit highly skilled personnel, especially to the extent other companies continue to allow more flexible remote working models. Attrition and workforce reorganizations and reductions have also and might continue to adversely affect our reputation among job seekers, demoralize our remaining employees, and result in a loss of institutional know-how, reduced productivity, slower customer service response, reduced effectiveness of internal compliance and risk-mitigation programs, and cancellations of or delays in completing new product developments and other strategic projects. For example, in the periods immediately following our recent restructurings, we experienced higher rates of voluntary employee attrition and declines in reported employee job satisfaction. We might continue to experience difficulty in hiring and retaining highly skilled employees with appropriate qualifications. We believe that a critical component of our efforts to attract and retain employees has been our corporate culture of innovation. We have invested substantial time and resources in building our team. As we continue to expand internationally, we will face new challenges to maintain our corporate culture of innovation among a larger number of geographically dispersed and remote employees, as well as other service providers. Failure to preserve our company culture could harm our ability to retain and recruit personnel. If we are unable to attract, integrate, retain, or effectively replace our key employees and qualified and highly skilled personnel, our ability to effectively focus on and pursue our corporate objectives will decline, and our business and future growth prospects could be harmed.

We rely on certain third-party computer systems or third-party service providers, including several cloud technology providers such as Amazon Web Services (on which we primarily rely to deliver our services to customers on our platforms), internet service providers, payment services providers, market and third-party data providers, regulatory services providers, clearing systems, market makers, exchanges, facilitators of cryptocurrency staking services for RHEU customers, alternative trading systems (such as Blue Oceans ATS, LLC (“BOATS”) with respect to Robinhood 24 Hour Market), exchange systems, (such as ForecastEx, LLC and KalshiEx LLC, with respect to certain event contracts), banking systems, payment gateways that link us to the payment card and bank clearing networks to process transactions, co-location facilities, communications facilities, and other third-party facilities to run our platforms, facilitate trades by our customers, provide the technology we use to manage some of our cryptocurrency custody, transfer, and settlement operations and support or carry out some regulatory obligations. In addition, external content providers provide us with financial information, market news, charts, option and stock quotes, cryptocurrency quotes, research reports, and other fundamental data that we provide to our customers. These providers are susceptible to processing, operational, technological and security vulnerabilities, including security breaches, which might impact our business, and our ability to monitor our third-party service providers’ data security is limited. In addition, these third-party service providers might rely on subcontractors to provide services to us that face similar risks. We face a risk that our third-party service providers might be unable or unwilling to continue to provide these services to meet our current needs in an efficient, cost-effective manner or to expand their services to meet our needs in the future. Any failures by our third-party service providers that result in an interruption in service, unauthorized access, misuse, loss or destruction of data or other similar occurrences could interrupt our business, cause us to incur losses, result in decreased customer satisfaction and increase customer attrition, subject us to customer complaints, significant fines, litigation, disputes, claims, regulatory investigations or other inquiries and harm our reputation. Regulators might also hold us responsible for the failures of our providers. For example, after BOATS, the trading venue that primarily supports overnight trading on Robinhood 24 Hour Market (8:00 pm - 4:00 am ET), experienced disruptions during the overnight trading session on August 4-5, 2024, we received requests for information from certain regulators.

We currently facilitate customer trades for certain cryptocurrencies that we have analyzed under applicable internal policies and procedures and, for cryptocurrencies supported on our the RHC platform, that we believe are not securities under U.S. federal and state securities laws. Determining whether any given cryptocurrency is a security is a highly complex, fact-driven analysis, the outcome of which is difficult to predict and may evolve over time based on changes in the cryptocurrency and its related ecosystem. Different parties may reach different conclusions about the outcome of this analysis based on the same facts. The analysis may become clearer depending on the outcome in certain cases currently pending in varying stages of litigation. The SEC Staff has indicated that the determination of whether or not a cryptocurrency is a security depends on the characteristics and use of that particular asset. The SEC and the SEC Staff have taken positions that certain cryptocurrencies are “securities” in the context of settled or litigated enforcement actions. Otherwise, the SEC has not historically provided advance confirmation on the status of any particular cryptocurrency as a security and the current presidential administration and control of Congress in the U.S. present considerable uncertainty as to cryptocurrency regulations. While prior public statements by senior officials at the SEC indicated that the SEC does not intend to take the position that Bitcoin or Ethereum are securities (in their current forms), Bitcoin and Ethereum were the only specific cryptocurrencies as to which senior officials at the SEC had publicly expressed such a view. Moreover, such statements are not official policy statements by the SEC and reflect only the speakers’ views, which are not binding on the SEC or any other agency or court, cannot be generalized to any other cryptocurrency, and might evolve. With respect to all other cryptocurrencies, there is currently no certainty under the applicable legal test that such assets are not securities, and U.S. regulators have expressed concerns about cryptocurrency platforms adding multiple new coins, some of which the regulators question might be unregistered securities. Although our policies and procedures are intended to enable us to make risk-based assessments regarding the likelihood that a particular cryptocurrency could be deemed a security under applicable laws, including federal securities laws, our assessments are not definitive legal determinations as to whether a particular digital asset is a security under such laws. Accordingly, regardless of our conclusions, we could be subject to legal or regulatory action in the event the SEC or a court were to assert or determine that a cryptocurrency supported by our RHC platform is a “security” under U.S. law. In June 2023, the SEC charged Binance Holdings Ltd., and its affiliated U.S. entity, among others (collectively, “Binance”) and, separately, Coinbase Global, Inc., and Coinbase, Inc. (collectively, “Coinbase”) with operating their respective cryptocurrency trading platforms as unregistered national securities exchanges, brokers, and clearing agencies, also alleging that certain cryptocurrencies supported on their respective platforms are securities. The charges also implicated Coinbase’s staking-as-a-service program and its non-custodial wallet. Although we have since ceased support for certain cryptocurrencies, including Polygon, we do support Cardano and Solana on our RHC platform and offer the Robinhood Wallet, which is a self-custodial crypto wallet. While the SEC’s September 2024 memorandum of law in support of motion for leave to amend the complaint against Binance states that the SEC’s prior use of “crypto asset securities” when referring to cryptocurrency assets did not mean that the SEC was referring to the “crypto asset itself as the security” but that the cryptocurrencies at issue were offered and sold as investment contracts (and therefore are securities), the SEC’s approach going forward remains unclear in light of this memorandum of law in support of motion for leave to amend the complaint as well as the August 2024 decision in the SEC’s case against Payward, Inc. and Payward Ventures, Inc. that the cryptocurrencies at issue were not themselves securities but were offered as, or sold as, investment contracts (and therefore were securities). The outcome of these matters and decisions by regulators not to bring enforcement actions provides, and any other action, settlement, or related investigation by regulators, might provide, additional guidance on the legal status of cryptocurrencies as securities more generally, which has affected and might significantly affect the actual or perceived regulatory status and value of cryptocurrencies we currently support or might support in the future. On January 21, 2025, the SEC announced that SEC Acting Chairman Mark Uyeda “launched a crypto task force dedicated to developing a comprehensive and clear regulatory framework for crypto assets.” The task force will be focused on helping the SEC “draw clear regulatory lines, provide realistic paths to registration, craft sensible disclosure frameworks, and deploy enforcement resources judiciously.” While the SEC has formed the Crypto Task Force to provide clarity on the application of the federal securities laws to the crypto asset market and to recommend practical policy measures that aim to foster innovation and protect investors, the task force has only recently begun. From time to time, we also have received, and might in the future receive SEC inquiries regarding specific cryptocurrencies supported on our RHC platform and added features and since December 2022, following the 2022 Crypto Bankruptcies, we have received investigative subpoenas from the SEC regarding, among other topics, RHC’s supported cryptocurrencies, custody of cryptocurrencies, and platform operations. During our discussions with the SEC Staff in the fourth quarter of 2023, the Staff asserted that they are considering whether, and may recommend that the SEC find that, certain cryptocurrencies supported by our RHC platform are securities, and in the second quarter of 2024, we received the May 2024 Wells Notice (as defined in Note 16 - Commitments & Contingencies to our consolidated financial statements in this Annual Report). The potential action related to the May 2024 Wells Notice may involve a civil injunctive action, public administrative proceeding, and/or a cease-and-desist proceeding and may seek remedies that include an injunction, a cease-and-desist order, disgorgement, pre-judgment interest, civil money penalties, and censure, revocation, and limitations on activities. To the extent that the SEC or a court asserts or determines that any cryptocurrencies supported by our RHC platform are securities, that assertion or determination could prevent us from continuing to facilitate trading of those cryptocurrencies (including ceasing support for such cryptocurrencies on our RHC platform). It could also result in regulatory enforcement penalties and financial losses in the event that we have liability to our customers and need to compensate them for any losses or damages. We could be subject to judicial or administrative sanctions, including disgorgement or penalties which could be material, for failing to offer or sell the cryptocurrency in compliance with securities registration requirements, or for acting as a securities broker or dealer, national securities exchange, clearing agency, or other regulated entity without appropriate registration. Such an action could result in injunctions and cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, criminal liability, and reputational harm. Customers that traded such supported cryptocurrency through our RHC platform and suffered trading losses might also seek to rescind transactions that we facilitated on the basis that they were conducted in violation of applicable law, which could subject us to significant liability and losses. We might also be required to cease facilitating transactions in the supported cryptocurrency, which could negatively impact our business, operating results, and financial condition. Further, if Bitcoin, Ethereum, or any other supported cryptocurrency is deemed to be a security, it might have adverse consequences for such supported cryptocurrency. For instance, all transactions in such supported cryptocurrency would have to be registered with the SEC or other foreign authority, or conducted in accordance with an exemption from registration, which could severely limit its liquidity, usability, and transactability. Moreover, the networks on which such supported cryptocurrencies are used might be required to be regulated as securities intermediaries, and subject to applicable rules, which could effectively render the network impracticable for its existing purposes. In April 2023, the SEC reopened the comment period and provided supplemental information on proposed amendments to the definition of “exchange” under Exchange Act Rule 3b-16, including reiterating the applicability of existing rules to platforms that trade crypto asset securities. Additionally, any determination that Bitcoin or Ethereum is a security could draw negative publicity and cause a decline in the general acceptance of cryptocurrencies. Also, it would make it more difficult for Bitcoin or Ethereum, as applicable, to be traded, cleared, and custodied as compared to other cryptocurrencies that are not considered to be securities. In addition, our growth might be adversely affected if we are not able to expand our RHC platform to include additional cryptocurrencies that the SEC has determined to be securities or that we believe are likely to be determined to be securities. We continue to analyze the cryptocurrencies supported on the RHC platform under our internal policies and procedures (collectively, our “RHC Crypto Listing Framework”) on a periodic basis to ensure that they continue to meet our requirements for continued support on the RHC platform which include, among other factors, that we continue to believe they are not securities under U.S. federal and state securities laws. We may make the determination to cease support for a cryptocurrency for any one or a variety of factors based on a totality of the circumstances under our RHC Crypto Listing Framework. However, an assertion or determination by the SEC or a court that a cryptocurrency supported by our RHC platform constitutes a security could also result in our determination that it is advisable to remove that and other cryptocurrencies from our RHC platform that have similar characteristics to the cryptocurrency that was asserted or determined to be a security. If we proactively remove certain cryptocurrencies from our RHC platform because the SEC or a court has asserted or determined they constitute securities or because they share similarities with such cryptocurrencies or otherwise do not meet our RHC Crypto Listing Framework, it has and could in the future negatively impact customer sentiment and our business, operating results, and financial condition, especially to the extent that our competitors continue to support such cryptocurrency on their platforms.