SoFi Technologies, Inc. Common Stock

Stakeholder relations · Investor relations and market confidence

We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which could cause our stock price to decline.

Technology infrastructure · Legacy systems and technical debt

We are required to continuously develop and adapt our systems and infrastructure in response to the increasing sophistication of the consumer financial services market, changing technologies, an evolving fraud, privacy and information security landscape, and regulatory developments.

Cybersecurity and data protection · Data breaches and cyber attacks

A cyberattack or other security incident could result in significant costs and adversely affect our business, financial condition and results of operations. These costs include expenses for incident response, forensic investigations, system and member remediation, data recovery, and business interruption, as well as legal, regulatory, and contractual costs.

Cybersecurity and data protection · Insider threats and access controls

Security incidents, data breaches, or compromises could occur from outside our company, and also from the actions of persons inside our company who may have authorized or unauthorized access to our technology systems, despite our investment in security controls.

Technology infrastructure · Disaster recovery and business continuity

Although we maintain a disaster response plan and insurance, such events could disrupt our business, the business of our partners or third-party suppliers, and may cause us to experience losses and additional costs to maintain and resume operations.

Cybersecurity and data protection · Data privacy and protection regulations

Regulations relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information, and adversely affect our business opportunities.

Technology infrastructure · Technology systems and infrastructure failure

Disruptions in the operation of our computer systems and third-party data centers and service providers could have an adverse effect on our business. Our computer systems and third-party providers may encounter service interruptions at any time due to system or software failure or errors.

Strategic execution · Geographic expansion and market entry

We may continue to expand operations abroad where we have limited operating experience and may be subject to increased business, economic and regulatory risks that could adversely impact our financial results.

Market position and competition · Disruptive competitors and new market entrants

In addition to established enterprises, we may also face competition from early-stage companies, or companies in industries not typically associated with financial services, such as social media and other commerce platforms, attempting to capitalize on the same, or similar, opportunities as we are.

Market position and competition · Market cyclicality and demand volatility

Decreased demand for certain lending products due to changes in interest rates, such as student loans and home loans, could negatively impact our results of operations.

Innovation and product development · Product development and randd investment risks

Demand for our products may decline if we do not continue to innovate or respond to evolving technological or other changes. We operate in a dynamic industry characterized by rapidly evolving technology, frequent product introductions, and competition based on product availability, pricing and other differentiators.

Customer and revenue · Changing customer preferences and behavior

We continue to increase the number of members utilizing our non-lending products, including our direct deposit feature, and maintain and build on the loyalty of existing members by increasing their use of new or additional products.

Credit and liquidity · Liquidity and cash flow constraints

If we are unable to successfully manage our assets and liabilities on the balance sheet and our funding costs, including with respect to deposit-based funding, our ability to finance additional loans and introduce new products may be negatively impacted.

International and currency · International operations and emerging markets

In April 2020, we undertook our first international expansion by acquiring 8 Limited, an investment business in Hong Kong. Additionally, with the acquisition of Galileo in May 2020, we gained clients in Canada, Mexico and Colombia and, with the acquisition of Technisys in March 2022, we further expanded our operations into Latin America.

Project and contract management · Project execution and delivery risks

We may be unable to realize the anticipated benefits of acquiring Technisys. We closed the Technisys acquisition in March 2022 and its operations have been largely integrated into our business.

Project and contract management · Service level and performance guarantees

Any failure on our part or on the part of third parties on whom we rely to perform functions related to our servicing activities to properly service our loans or the loans originated by third parties could result in us being removed as the servicer on the loans.

Geopolitical and trade · Government funding and budget changes

Federal government shutdowns, developments related to the U.S. federal debt ceiling, changes in legislation, regulations or policy may affect our business.

Legal and litigation · Contractual disputes and claims

We make representations and warranties in connection with the transfer of loans to whole loan purchasers, Loan Platform Business counterparties, government-sponsored enterprises, and our debt warehouse lenders and securitization trusts.

Data and privacy · Consumer privacy and consent

The CFPB, for example, finalized its Personal Financial Data Rights Rule, which could require us to build an application that allows our customers to obtain their personal financial information and for authorized third parties to obtain our customers' information.

Data and privacy · Cross border data transfer regulations

If we collect and process personal data relating to individuals in the EU or the United Kingdom (the 'UK') as a result of either offering goods or services into the EU or UK, or monitoring the behavior of EU and UK individuals, we will be required to comply with stringent privacy and data protection laws.