Risk Factors Update Summary

• Amended CCPA to CPRA, creating new state agency, and passed comprehensive privacy laws in various states.
• Addition of deposits to funding sources may impact liquidity. Increased focus on compliance.
• Revenue from clients is highly concentrated. A reduction in revenue from key clients could have a material adverse effect.
• New regulations require written cybersecurity policies and procedures, with fines up to 4% of annual revenue.
• Proposed rules for investment advisers in 2023 may impose significant costs on the business.
• SoFi Bank gained direct access to debit networks, performing services previously sponsored by a third-party bank.
• Stricter data privacy laws impose fines of up to 20 million Euros or 4% of global revenue.
• Changes in regulations could impact securities lending market, leading to decreased revenue.
• Ceased offering digital asset-related trading services in all states except New York in December 2023.
• Potential impact on student loan refinancing due to legislative and regulatory actions.
• Increased URG representation goals: URG population to 60%, management to 50%, and executive workforce to 51%.
• Acquisition of Wyndham adds liability for mortgage loans, including repurchase obligations.
• Enhanced disclosures required in securities lending market may increase costs and reduce activity.
• Increased regulatory scrutiny on BaaS solutions may affect revenue and operations.
• Introduction of SoFi Checking and Savings products to attract and retain members.
• Failures in loan servicing could result in penalties or liabilities, impacting financial results.
• Increased focus on privacy and cybersecurity regulations may require modifications to data collection practices.
• Increased restrictions on cross-border data transfers may lead to compliance challenges and increased costs.
• Enhanced DE & I focus with quarterly OKR process, aiming to improve representation and create a sense of belonging.
• Potential impact of proposed rules on conflicts of interest associated with predictive data analytics.
• Expanded accountability metrics to include retention, promotion, and engagement, reviewed bi-annually with business leaders.
• Introduced new ESG Committee to track progress and execute strategies for greater impact.
• Transitioned to a hybrid work model, offering employees the choice of in-office or remote work.
• Proposed rules to address conflicts of interest in investor interactions using predictive data analytics.
• Increased regulatory scrutiny related to prior business practices in the digital assets sector.