SoFi Technologies (SOFI) Risk Factors

We became a publicly traded company by completing a transaction with SCH, a SPAC. As a result of this transaction, regulatory obligations have, and may continue, to impact us differently than other publicly traded companies. For instance, the SEC and other regulatory agencies may issue additional guidance or apply further regulatory scrutiny to companies like us that have completed a business combination with a SPAC. Managing this regulatory environment, which has and may continue to evolve, could divert management's attention from the operation of our business, negatively impact our ability to raise additional capital when needed or have an adverse effect on the price of our common stock.

Our business is subject to increased risks of litigation and regulatory actions as a result of a number of factors and from various sources, including as a result of the highly regulated nature of the financial services industry and the focus of state and federal enforcement agencies on the financial services industry. From time to time, we are also involved in, or the subject of, reviews, requests for information, investigations and proceedings (both formal and informal) by state and federal governmental agencies and SROs, regarding our business activities and our qualifications to conduct our business in certain jurisdictions, which has in the past and could in the future subject us to significant fines, penalties, obligations to change our business practices and other requirements resulting in increased expenses and diminished earnings. Our involvement in any such matter also has in the past and could in the future cause significant harm to our reputation and divert management attention from the operation of our business, even if the matters are ultimately determined in our favor. Moreover, any settlement, or any consent order or adverse judgment in connection with any formal or informal proceeding or investigation by a government agency, may prompt litigation or additional investigations or proceedings as other litigants or other government agencies begin independent reviews of the same activities. See "If we fail to comply with federal and state consumer protection laws, rules, regulations and guidance, our business could be adversely affected" for a discussion of the FTC Consent Order. In addition, a number of participants in the financial services industry have been the subject of: putative class action lawsuits; state attorney general actions and other state regulatory actions; federal regulatory enforcement actions, including actions relating to alleged unfair, deceptive or abusive acts or practices; violations of state licensing and lending laws, including state usury laws; actions alleging discrimination on the basis of race, ethnicity, gender or other prohibited bases; and allegations of noncompliance with various state and federal laws and regulations relating to originating and servicing consumer finance loans. For example, we entered into a settlement agreement on April 18, 2022 related to a putative class action in which it was alleged that we engaged in unlawful lending discrimination through policies and practices by making applicants?who are conditional permanent residents or DACA holders?ineligible for loans or eligible only with a co-signer who is U.S. citizen or lawful permanent resident. We made an aggregate payment to the class and the class counsel in an immaterial amount. In addition, as a financial services company, errors in performing settlement functions, including clerical, technological and other errors related to the handling of funds and securities could lead to censures, fines or other sanctions imposed by applicable regulatory authorities as well as losses and liabilities in related lawsuits and proceedings brought by transaction counterparties and others. The current regulatory environment, increased regulatory compliance efforts and enhanced regulatory enforcement have resulted in significant operational and compliance costs and may prevent us from providing certain products and services. There is no assurance that these regulatory matters or other factors will not, in the future, affect how we conduct our business and, in turn, have a material adverse effect on our business. In particular, legal proceedings brought under state consumer protection statutes or under several of the various federal consumer financial services statutes may result in a separate fine for each violation of the statute, which, particularly in the case of class action lawsuits, could result in damages substantially in excess of the amounts we earned from the underlying activities. In addition, from time to time, through our operational and compliance controls, we identify compliance and other issues that require us to make operational changes and, depending on the nature of the issue, result in financial remediation to impacted members. These self-identified issues and voluntary remediation payments could be significant, depending on the issue and the number of members impacted, and also could generate litigation or regulatory investigations that subject us to additional risk. See Part II, Item 1. "Legal Proceedings".

We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by them. For example, we are subject to the GLBA and implementing regulations and guidance. Among other things, the GLBA (i) imposes certain limitations on the ability to share consumers' nonpublic personal information with nonaffiliated third parties and (ii) requires certain disclosures to consumers about our practices for the collection, sharing and safeguarding of their information and their right to "opt out" of the institution's disclosure of their personal financial information to nonaffiliated third parties (with certain exceptions). The GLBA and other state laws also require that we implement and maintain certain security measures, policies and procedures to protect personal information. Furthermore, legislators and/or regulators are increasingly adopting new and/or amending existing privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices; our policies and practices related to the collection, use, sharing, retention and safeguarding of consumer and/or employee information; and some of our current or planned business activities. New requirements, originating from new or amended laws, could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. Compliance with current or future privacy, information security and data protection laws (including those regarding security breach notification) affecting customer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve sharing information with third parties or storing sensitive credit card information), which could materially and adversely affect our profitability. A failure by us or a third-party contractor providing services to us to comply with applicable data privacy and security laws, regulations, self-regulatory requirements or industry guidelines, or our terms of use with our users, may result in sanctions, statutory or contractual damages or litigation (including class actions) and may subject us to reputational harm. Additionally, there is always a danger that regulators can attempt to assert authority over our business in the area of privacy, information security and data protection. Furthermore, if our vendors and/or service providers are or become subject to laws and regulations in the jurisdictions that have enacted more stringent and expansive legislation applicable to privacy, information and/or data protection, the costs that these vendors and service providers must incur in becoming compliant may be passed along to us, resulting in increasing costs on our business. Concerns in our ability, perceived or otherwise, to protect the privacy and security of personal information may affect our ability to retain and engage new and existing members, clients, investors, and employees, and thereby affect our financial condition. Furthermore, failure to comply or perceived failure to comply with applicable privacy or data protection laws, rules, and regulations may subject us to examinations, investigations, and general heightened scrutiny that may cause us to modify or cease certain operations or practices, significant liabilities or regulatory fines, penalties or other sanctions. Any of these could damage our reputation and adversely affect our business, financial condition, and results of operations. Privacy requirements, including notice and opt-out requirements, under the GLBA and FCRA are enforced by the FTC, the OCC and by the CFPB through UDAAP and are a standard component of OCC and CFPB compliance and examinations. State entities also may initiate actions for alleged violations of privacy or security requirements under state law. Our failure to comply with privacy, information security and data protection laws could result in potentially significant regulatory investigations and government actions, litigation, fines or sanctions, consumer or merchant actions and damage to our reputation and brand, all of which could have a material adverse effect on our business. If we collect and process personal data relating to individuals in the EU or the United Kingdom (the "UK") as a result of either offering goods or services into the EU or UK, or monitoring the behavior of EU and UK individuals, we will be required to comply with stringent privacy and data protection laws. Within the EU, legislators have adopted the General Data Protection Regulation (the "EU GDPR"), which became effective in May 2018. The EU GDPR will impose additional obligations and risk upon our business, which may increase substantially the penalties to which we could be subject in the event of any noncompliance. We may incur substantial expense in complying with obligations imposed by the EU GDPR and we may be required to make significant changes in our business operations, all of which may adversely affect our revenues and our business overall. In addition, further to the UK's exit from the EU on January 31, 2020, the EU GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the UK's European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK specific amendments) into UK law, referred to as the "UK GDPR". The UK GDPR and the UK Data Protection Act 2018 set out the UK's data protection regime, which is independent from but aligned to the EU's data protection regime. Noncompliance with the UK GDPR may result in significant monetary penalties. Although the UK is regarded as a third country under the EU's GDPR, the EC has issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. In addition, around the world many jurisdictions outside of Europe are also considering and/or have enacted comprehensive data protection legislation. For example, we are subject to stringent privacy and data protection requirements in Hong Kong. Also, many jurisdictions where we may seek to expand our business in the future are also considering and/or have enacted comprehensive data protection legislation. Additional jurisdictions with stringent data protection laws include Brazil and China. In the United States, the SEC proposed multiple rules related to privacy and cybersecurity in March 2023. Proposed amendments to Regulation S-P would, among other things: (i) require covered institutions (including broker-dealers and investment advisers) to adopt written policies and procedures for an incident response program to address unauthorized access to or use of customer information; and (ii) require covered institutions to have written policies and procedures to provide timely notification to affected individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization. The SEC reopened the comment period for the Investment Management Cybersecurity Release which proposed new rules that would require registered investment advisers and investment companies to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks, disclose information about cybersecurity risks and incidents, report information confidentially to the SEC about certain cybersecurity incidents, and maintain related records. While we believe we have robust policies and procedures addressing incidents involving unauthorized access to or use of customer information, these regulations have and may in the future require us to amend our current incident response program. In addition, these regulations may interfere with our intended business activities, inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs. The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with laws in other jurisdictions or with our existing data management practices or the features of our services and platform capabilities. We therefore cannot yet fully determine the impact existing and/or future laws, rules, regulations and industry standards may have on our business or operations. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the imposition of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations. Any such laws, rules, regulations and industry standards may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices. Additionally, our customers may be subject to differing privacy laws, rules and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Adherence to such contractual requirements may impact our collection, use, processing, storage, sharing and disclosure of various types of information including financial information and other personal information, and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules and regulations evolve. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business. As we expand our customer base, these requirements may vary from customer to customer, further increasing the cost of compliance and doing business. We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of data. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so. Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer-protection related laws, regulations, orders or industry standards could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices, which could, individually or in the aggregate, materially and adversely affect our business, financial condition and results of operations.

We operate in an industry in which integrity and the confidence of our members is of critical importance. We are subject to risks of errors and misconduct by our employees that could adversely affect our business, including: - engaging in misrepresentation or fraudulent activities when marketing or performing online brokerage and other services to our members;- improperly using or disclosing confidential information of our members, technology platform clients, or other parties;- concealing unauthorized or unsuccessful activities; or - otherwise not complying with applicable laws and regulations or our internal policies or procedures. There have been numerous highly-publicized cases of fraud and other misconduct by financial services industry employees. The precautions that we take to detect and deter employee misconduct might not be effective. If any of our employees engage in illegal, improper, or suspicious activity or other misconduct, we could suffer serious harm to our reputation, financial condition, member relationships, and our ability to attract new members. We also could become subject to regulatory sanctions and significant legal liability, which could cause serious harm to our financial condition, reputation, member relationships and prospects of attracting additional members. Risk Management and Financial Reporting Risks

Our business, results of operations and reputation are directly affected by elements beyond our control, including general economic, political, social and health conditions in the U.S. and in countries abroad. These elements can arise suddenly and the full impact can remain unknown or result in adverse effects, including, but not limited to, extreme volatility in credit, equity and foreign currency markets, changes to buying patterns of our members and prospective members or reductions in the credit quality of our members, and changes to the financial condition of our technology platform clients and prospective clients. In particular, markets in the U.S. or abroad have been and may in the future be affected by the level and volatility of interest rates, availability and market conditions of financing, recessionary pressures, inflation and hyperinflation, supply chain disruptions, changes in consumer spending, employment levels, labor shortages, federal government shutdowns, developments related to the U.S. federal debt ceiling, changes in legislation, regulations or policy, energy prices, home prices, commercial property values, bankruptcies, a default by a significant market participant or class of counterparties, market volatility, liquidity of the global financial markets, the growth of global trade and commerce, exchange rates, trade policies, the availability and cost of capital and credit, disruption of communication, transportation or energy infrastructure and investor sentiment and confidence. Additionally, global markets have been and may in the future be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict, (e.g., the escalating conflict in the Middle East and the ongoing war in Ukraine), terrorism or other geopolitical events, including the upcoming changes to the United States presidential administration, which may affect our results of operations. For example, although we do not have operations in the locations impacted by these conflicts, the ongoing war in these locations has led and could in the future lead to macroeconomic effects, including volatility in commodity prices and the supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability, as well as an increase in cyberattacks and espionage. Also, any sudden or prolonged market downturn in the U.S. or abroad, as a result of the above factors or otherwise, could adversely affect our business, results of operations and financial condition, including capital and liquidity levels. We are not able to predict with any certainty the ultimate impact that any of these events, as well as any other future events, may have on our business. Significant downturns in the securities markets or in general economic and political conditions may also decrease the demand for our products and services and could also result in our members reducing their engagement with our platform. In addition, such significant downturns may cause default rates on our loans to increase and cause funding and liquidity concerns for our current and prospective technology platform clients reducing their adoption and use of our platform as a service products and services. Conversely, significant upturns in the securities markets or in general economic and political conditions may cause individuals to be less proactive in seeking ways to improve the returns on their trading or investment decisions and, thus, decrease the demand for our products and services. Any of these changes could cause our future performance to be uncertain or unpredictable, and could have an adverse effect on our business, financial condition and results of operations. In addition, a prolonged weakness in the U.S. equity markets or a general extended economic downturn could cause our members or technology platform clients to incur losses, which in turn could cause our brand and reputation to suffer. If our reputation is harmed, the willingness of our existing members or technology platform clients and potential new members or clients to do business with us could be negatively impacted, which would adversely affect our business, financial condition and results of operations. Our business is sensitive to interest rates and interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, in particular, the Federal Reserve. The Federal Reserve increased interest rates throughout 2022 and multiple times in 2023, and we are unable to predict whether it will continue to raise rates further or continue to lower rates. Further changes to prevailing interest rates could influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes have in the past and could in the future also affect (i) our ability to originate loans at competitive rates and obtain deposits; (ii) the fair value of our financial assets and liabilities; (iii) the average duration of our loan portfolios and other interest-earning assets; (iv) the mix of lending products we originate which is influenced by demand for refinancing products; and (v) the competition faced by our SoFi Money deposit product from other investment products which may become more attractive as interest rates rise. See "Changing expectations for inflation and deflation and corresponding fluctuations in interest rates could decrease demand for our lending products and negatively affect loan performance, as well as increase certain operating costs, such as employee compensation" for additional information on the risks of interest rate fluctuations to our business. Interest rate changes and other actions, including balance sheet management, lending facilities, and the Federal Reserve's exit from quantitative easing, and similar actions taken by the Federal Reserve or other central banks, are beyond our control and difficult to predict. These actions affect interest rates and the value of financial instruments, increase the likelihood of a more volatile market, a further appreciating U.S. dollar and negative growth in gross domestic product, and affect other assets and liabilities and can impact our members and technology platform clients. Any such downturn, especially in the regions in which we operate, may adversely affect our asset quality, deposit levels, loan demand and results of operations. Changes to existing laws, regulations and policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, cybersecurity and privacy, digital assets, climate change (including any required reduction of greenhouse gas emissions) and healthcare, may adversely impact U.S. or global economic activity and our members, our technology platform clients, our counterparties and our earnings and operations. For example, changes, or proposed changes, to certain U.S. trade and international investment policies, particularly with important trading partners (including China and the European Union (the "EU")) have in recent years negatively impacted financial markets. Actions taken by other countries, particularly China, to restrict the activities of businesses, could also negatively affect financial markets. An escalation of tensions, such as a further escalation in conflict in the Middle East, could lead to further measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of duties and tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury Bonds. Any of these developments could adversely affect our business, our members, our technology platform clients, the value of our loan portfolios, our level of charge-offs and provision for credit losses, our capital levels, our liquidity and our results of operations.

Occurrences of epidemics or pandemics, depending on their scale, may cause different degrees of disruption to the regional, state and local economies in which we offer our products and services. For example, the COVID-19 pandemic caused changes in consumer and student behavior, as well as economic disruptions. Any future pandemic or public health crisis may result in, among other impacts, worker shortages, supply chain issues, inflationary pressures, and the reinstatement and subsequent lifting of restrictions and health and safety related measures. Any COVID-19 resurgences or future epidemics or pandemics or other public health crises could adversely affect our business, operations and financial condition, as well as the business, operations and financial conditions of our members, other customers and partners. See "Our business and results of operations have in the past and may in the future be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions generally" and "Management's Discussion and Analysis of our Financial Condition and Results of Operations-Key Business Metrics" and "-Consolidated Results of Operations" for further discussion of the impact of macroeconomic conditions in recent periods on our business and operating results. Strategic and New Product Risks

We incorporate open source software into our proprietary platform and into other processes supporting our business. Such open source software may include software covered by licenses like the GNU General Public License and the Apache License or other open source licenses. The terms of various open source licenses have not been interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that limits our use of the software, inhibits certain aspects of our platform and negatively affects our business operations. Some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use. If portions of our proprietary platform are determined to be subject to an open source license, or if the license terms for the open source software that we incorporate change, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our platform or change our business activities. In addition to risks related to license requirements, the use of open source software can lead to greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with the use of open source software cannot be eliminated and could adversely affect our business.