In evaluating our company and our business, you should carefully consider the risks and uncertainties described in Part I, Item 1A. Risk Factors in our Annual Report on Form 10-K, together with the other information in this Quarterly Report on Form 10-Q, including our condensed consolidated financial statements and the related notes and the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and in other documents we file with the SEC. There are no material changes from the risk factors set forth in our 2025 Annual Report on Form 10-K except as set forth below. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also impair our business, reputation, financial condition, results of operations, revenue or our future prospects, or market price of our common stock. Inadequate self-insurance accruals or insurance coverage for employee healthcare benefits could have an adverse effect on our business, financial results or financial condition. We self-insure for certain medical benefits, up to certain stop-loss limits. We accrue these costs based on known claims and estimates of incurred but not reported claims. Our actual liabilities may exceed our estimates of losses, which could adversely impact our business and financial conditions. We may also experience an unexpectedly large number of claims that result in costs or liabilities in excess of our projections, which could cause us to record additional expenses. The issuance and operation of SoFiUSD is complex and exposes us to risks related to compliance with regulations and maintaining its value, which could adversely affect our business and financial condition. We have recently issued a proprietary stablecoin named SoFiUSD. The design, issuance, and operation of a stablecoin could expose us to a range of significant risks, including regulatory, operational, liquidity, technological, and reputational risks. The legal and regulatory framework governing stablecoins remains uncertain and is evolving rapidly in the United States and internationally. New or changing laws, regulations, or supervisory expectations, including the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (the “GENIUS Act”), could restrict or prohibit our ability to issue or offer a stablecoin, require us to obtain licenses or approvals, impose capital or reserve requirements, or subject us to additional compliance, audit and disclosure obligations, any of which could delay, limit, or prevent the delivery of SoFiUSD or materially increase its cost. In addition, the GENIUS Act requires us to establish and migrate SoFiUSD to a separately licensed or regulated entity. The issuance and operation of SoFiUSD also presents unique compliance challenges. Although we are already subject to anti-money laundering, sanctions, and related compliance obligations under the Bank Secrecy Act, the USA PATRIOT Act, and regulations administered by FinCEN and OFAC, the nature of blockchain-based transactions, including the speed of transfers and the potential for pseudonymous activity, creates complexities in monitoring transactions, screening for sanctioned parties, and detecting illicit activity that differ from our traditional banking operations. Once SoFiUSD is transferred on-chain, we may have limited visibility into subsequent transfers or the identity of holders. If SoFiUSD is used in connection with money laundering, terrorist financing, sanctions evasion, or other illicit activity—whether or not we have actual knowledge of such use—we could face regulatory enforcement actions, fines, reputational harm, and restrictions on our stablecoin operations. Our issuance of SoFiUSD also exposes us to counterparty, operational and liquidity risks. We engage a third party sub-servicer to provide technical and operational services, including for reserve management, and a portion of SoFiUSD reserve assets may be held in custodial accounts at other regulated financial institutions. We also face risks related to redemption demands and market stress, including the possibility that we may need to implement temporary limits on redemption amounts or timing to manage liquidity in extreme circumstances. Failure to maintain a stable value or to meet redemption requests could result in financial losses, customer claims, and reputational harm. In addition, operating a stablecoin requires robust technology infrastructure and controls, and could expose us to cybersecurity threats, fraud, operational failures, or disruptions in third-party service providers. Any such events, or negative perceptions of SoFiUSD or stablecoins generally, could adversely affect customer adoption, attract regulatory scrutiny, and harm our brand and business. Furthermore, the accounting rules and regulations that we must comply with are complex and subject to interpretation by FASB, the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these 109 SoFi Technologies, Inc. TABLE OF CONTENTS principles or interpretations could have a significant effect on our reported financial results and may even affect the reporting of transactions completed before the announcement or effectiveness of a change. Further, there have been limited precedents for the financial accounting of stablecoins and other digital assets and related valuation and revenue recognition considerations. As such, there remains significant uncertainty on how companies should account for stablecoin and other digital asset transactions, value, and related revenue. Uncertainties in or changes to regulatory or financial accounting standards could result in the need to change our accounting methods and/or restate our financial statements and impair our ability to provide timely and accurate financial information, which could adversely affect our financial statements, result in a loss of investor confidence, and more generally impact our business, results of operations, financial condition, and prospects.