MoneyLion (ML) Risk Factors

In the normal course of business, we collect, process, use and retain sensitive and confidential information regarding our customers and prospective customers, including data provided by and related to consumers and their transactions, as well as other data of the counterparties to their payments. We also have arrangements in place with certain third-party service providers that require us to share customer information. Although we devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of third-party service providers, are vulnerable to actual or threatened external or internal security breaches; acts of vandalism, theft, fraud or misconduct on the part of employees, other internal sources or third parties; computer viruses or malware; phishing attacks; internet interruptions; disruptions or losses; misplaced or lost data; ransomware; unauthorized encryption; denial-of-service attacks; social engineering; unauthorized access; spam or other attacks; natural disasters; fires; terrorism; war; telecommunications or electrical interruptions or failures; programming or human errors or malfeasance; and other similar malicious or inadvertent disruptions or events. We and our third-party service providers from time to time have experienced and may in the future continue to experience such instances, and we may experience heightened risks of cyberattacks and other security breaches or disruptions as a result of the ongoing unification efforts to integrate certain legacy IT infrastructure and systems of MALKA and Even Financial Inc. (now Engine by MoneyLion). The access by unauthorized persons to, or the improper disclosure by us of, confidential information regarding our customers or our proprietary information, software, methodologies and business secrets could interrupt our business or operations, result in legal claims or proceedings, significant legal and financial exposure, supervisory liability under U.S. federal or state or non-U.S. laws regarding the privacy and protection of information, including PII, damage to our reputation or a loss of confidence in the security of our systems, products and services, all of which could have a material adverse impact on our business. Although the impact to date from these events has not had a material adverse effect on us, no assurance is given that this will be the case in the future. In addition to cyberattacks, data security breaches and other similar incidents involving the theft of sensitive and confidential information, ransomware, hackers, terrorists, sophisticated nation-state and nation-state supported actors and other malicious third parties recently have engaged in attacks that are designed to disrupt key business services, such as consumer-facing websites, which attacks we have faced in the past and anticipate will continue to grow in scope and complexity over time. We and our third-party partners, service providers or vendors may not be able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used to sabotage or to obtain unauthorized access to our or our third-party partners', service providers' or vendors' technology, systems, networks and/or physical facilities in which data is stored or through which data is transmitted change frequently and because attacks can originate from a wide variety of sources. We employ detection and response mechanisms designed to contain and mitigate security incidents. Nonetheless, early detection efforts may be thwarted by sophisticated attacks and malware designed to avoid detection, and we may fail to detect the existence of a security breach related to the information of our customers and to prevent or detect service interruptions, system failure or data loss. Further, as many of our employees continue to work remotely, these cybersecurity risks may be heightened by an increased attack surface across our business and those of our customers and third-party partners, service providers and vendors. We cannot guarantee that our efforts, or the efforts of those upon whom we rely and with whom we partner, will be successful in preventing any such information security incidents. Information security risks in the financial services industry in particular are significant, in part because of new technologies, the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized criminals, perpetrators of fraud, hackers, terrorists and other malicious third parties. In addition, there have been a number of well-publicized attacks or breaches affecting companies in the financial services industry that have heightened concern by customers, which could also intensify regulatory focus, cause customers to lose trust in the security of the industry in general and result in reduced use of our services and increased costs, all of which could also have a material adverse effect on our business. The digital nature of our platform may also make it an attractive target for hacking and potentially vulnerable to security breaches and similar disruptions. Most jurisdictions (including all 50 states) have enacted laws requiring companies to notify individuals, regulatory authorities and/or others of security breaches involving certain types of data. In addition, our agreements with certain partners and service providers may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers, partners and service providers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach. A security breach of any of our vendors that processes PII may pose similar risks. A cyberattack, data security breach or other similar incident may also cause us to breach customer contracts. Our agreements with certain partners and service providers may require us to use industry-standard or reasonable measures to safeguard PII. We also may be subject to laws that require us to use industry-standard or reasonable security measures to safeguard PII. A cyberattack, data security breach or other similar incident could lead to claims by our customers or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action, and our customers could end their relationships with us. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages, and in some cases, our customer agreements may not limit our remediation costs or liability with respect to data breaches. Litigation resulting from cyberattacks, data security breaches or other similar incidents may adversely affect our business. Unauthorized access to our technology, systems, networks or physical facilities, or those of our third-party partners, service providers or vendors, could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management's time and attention, increase our costs of doing business or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our products and/or technology capabilities in response to such litigation, which could have an adverse effect on our business. If a cyberattack, data security breach or other similar incident were to occur, and the confidentiality, integrity or availability of PII was disrupted, we could incur significant liability, or our technology, systems or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation. While we maintain cybersecurity insurance, we may not have adequate insurance coverage with respect to liabilities that result from any cyberattacks, data security breaches or other similar incidents or disruptions suffered by us or third parties upon which we rely. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim.

We operate in rapidly changing and highly competitive industries. We compete across our business lines with a variety of competitors, including traditional banks and credit unions; new entrants obtaining banking licenses; non-bank digital providers offering banking-related services; specialty finance and other non-bank digital providers offering consumer lending-related or earned wage access products; digital wealth management platforms such as robo-advisors offering consumer investment services and other brokerage-related services; and digital financial platform, embedded finance and marketplace competitors, which aggregate and connect consumers to financial product and service offerings. We also compete with advertising agencies and other service providers to attract marketing budget spending from our Enterprise clients. We expect our competition to continue to increase, as there are generally no substantial barriers to entry to the markets we serve. Some of our current and potential competitors have longer operating histories, particularly with respect to financial services products similar to ours, significantly greater resources and a larger customer base than we do. This allows them, among other things, to potentially offer more competitive pricing or other terms or features, a broader range of financial or other products or a more specialized set of specific products or services, as well as respond more quickly than we can to new or emerging technologies and changes in consumer preferences. Our existing or future competitors may develop products or services that are similar to our products and services or that achieve greater market acceptance than our products and services. This could attract customers away from our services and reduce our market share in the future. In addition, we face competition in our media division from others in the digital media and content creation industry, which range from large and established media companies, including social media companies and production studios, to emerging start-ups. Established companies have longer operating histories and more established relationships with customers and users, and they can use their experience and resources in ways that could affect our competitive position, including by making acquisitions, investing aggressively in research and development, aggressively initiating intellectual property claims (whether or not meritorious) and competing aggressively for advertisers and websites. Emerging start-ups may be able to innovate and provide products and services faster than we can. Our operating results may suffer if our digital content is not appropriately timed with market opportunities, if our competitors are more successful than we are in developing compelling content, if we are unable to successfully innovate and provide superior services to clients or if our digital content is not effectively brought to market. Our results of operations and future prospects depend on our ability to compete effectively and attract new and retain existing customers and clients, which depends upon many factors both within and beyond our control, including those described in this "Risk Factors" section. In acting to meet these competitive challenges, we may be forced to increase marketing expenditures or utilize significant other resources. Competitive pressures could also result in us reducing the amounts we charge for our various products and services or incurring higher customer acquisition costs, and could make it more difficult for us to grow our product and service offerings in both number and volume for new as well as existing customers and clients. All of the foregoing factors and events could adversely affect our business, financial condition, results of operations and cash flows.

We operate in a dynamic industry characterized by rapidly evolving technology, frequent product and service offering introductions and competition based on pricing, innovative features and other differentiators. We rely on our proprietary technology to make our Consumer platform available to customers and to integrate our Enterprise platform with our Enterprise Partners' businesses. In addition, we may increasingly rely on technological innovation as we introduce new types of products and services, expand into new markets and continue to streamline our platform. The process of developing and integrating new technologies, including artificial intelligence ("AI") and machine learning models, is complex and may cause errors or inadequacies that are not easily detectable, and as we integrate more generative AI technology into our platform to improve the experience of our users, it may result in unintentional or unexpected outputs that are incorrect. If we are unable to successfully innovate and continue to deliver a high-quality, superior experience, demand for our products or services may decrease and our growth and operations may be harmed.

Maintaining and promoting our brand in a cost-effective manner is critical to achieving widespread acceptance of our products and services, retaining existing customers and clients and expanding our base of customers and clients. Maintaining and promoting our brand depends largely on our ability to continue to provide useful, reliable, secure and innovative products and services, the effectiveness of our marketing efforts, the experience of existing customers and clients, including our ability to provide high-quality support and solutions to quickly resolve issues or otherwise meet their needs, and our ability to maintain trust. We may introduce, or make changes to, features, products, services, privacy practices or terms of service that customers and clients do not like, which may materially and adversely affect our brand. Our efforts to build our brand have involved significant expense, and our marketing spend may increase in the near term or in the future. Our brand promotion activities, including efforts to create personalized content through our media division and any actions we take as part of any rebranding of our businesses, products or services, may not generate or maintain brand awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building and maintaining our brand. If we fail to successfully promote, protect and maintain our brand or if we incur excessive expenses in this effort, we may lose our existing customers and clients to our competitors or be unable to attract new customers and clients, which could have an adverse effect on our business and results of operations. We have been from time to time, and may in the future be, the target of incomplete, inaccurate and misleading or false statements about our company and our business that could damage our brand and deter the adoption of our platform. Harm to our brand can arise from many sources, including the quality and reliability of our products and services or changes thereto; the experience of our customers and clients with our products or services and our ability to effectively manage and resolve issues and complaints; our privacy, data protection and information security practices and our compliance and risk management processes; incidents or allegations of illegal or improper conduct by us, our partners or other counterparties; litigation or regulatory action; and any other negative publicity about our company, our key personnel, including management, and our content creators. If we do not successfully maintain a strong and trusted brand, our business could be materially and adversely affected.

Our success significantly depends on the continued service of our senior management team and other key personnel. Our success also depends on our ability to identify, hire, develop, motivate and retain highly qualified personnel for all areas of our organization. As a result, any shortage of qualified labor could significantly adversely affect our business. Labor shortages will also likely lead to higher wages for employees and result in direct and indirect increases in costs to us, which would reduce our profitability and could have a material adverse effect on our business, financial condition and results of operations. Competition for highly skilled personnel is extremely intense, particularly in New York, where our headquarters is located, and in Kuala Lumpur, where many of our engineering and data analytics personnel are located. We have experienced, and expect to continue to face, difficulty identifying, hiring and retaining qualified personnel and may also encounter difficulties in retaining key employees of acquired companies. In addition, we invest significant time and expense in training our employees, which increases their value to competitors who may seek to recruit them. If we fail to retain our employees, we could incur significant expenses in hiring and training their replacements. Many of the companies with which we compete for experienced employees have greater resources than we have and may be able to offer more attractive terms of employment. In particular, candidates making employment decisions, specifically in high-technology industries, often consider the value of any equity they may receive in connection with their employment. Any significant volatility in the price of our stock may adversely affect our ability to attract or retain highly skilled personnel. Further, many companies have adopted work-from-home policies that may be more flexible than ours, which further increases the challenges associated with hiring and retaining qualified personnel.