Dave IncDE

Previous wording

In May 2020, an unauthorized third party attempted to gain access to Dave Member accounts and was able to access Member profiles and Members’ partial or incomplete bank account information. We did not uncover any evidence that the attacker was able to take any actions with respect to the data, other than gaining read access to it, nor do we believe any unauthorized transactions were made or advances requested on the Dave system. We provided notice to relevant parties as required under applicable law and agreements and took steps to set up alerts to detect abnormal request volumes and introduced rate limiting at the IP address level. In addition, in June 2020, we were notified of an unauthorized third party breach of our Dave database. The third party was able to access to Dave’s system by breaching the system of one of Dave’s third party service providers. The attacker was able to download a large data set, including encrypted social security numbers for some Members; however, there was no evidence that unauthorized transactions were made or advances requested on the Dave system, nor do we believe that the third party gained access to decryption keys or was otherwise able to decrypt encrypted information. The May 2020 and June 2020 incidents are collectively referred to herein as the "2020 Incidents." We took remedial measures, including the engagement of an outside security consultant to monitor for ongoing dark web activity and to conduct a security audit and incident investigation, and notified relevant parties as required under applicable law and agreements. As a result of the 2020 Incidents, we are in the process of settling a purported class action in California for approximately $3.1 million and we settled individual claims outside of California for approximately $4.4 million. See Item 1. Legal Proceedings. In addition, in 2024, one of our third-party service providers experienced a data breach that resulted in improper disclosure of certain of our Members’ information. As we have increased our Member base and our brand has become more widely known and recognized, third parties may continue to seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our Members’ data.

Current wording

In May 2020, an unauthorized third party attempted to gain access to Dave Member accounts and was able to access Member profiles and Members’ partial or incomplete bank account information. We did not uncover any evidence that the attacker was able to take any actions with respect to the data, other than gaining read access to it, nor do we believe any unauthorized transactions were made or advances requested on our platform. We provided notice to relevant parties as required under applicable law and agreements and took steps to set up alerts to detect abnormal request volumes and introduced rate limiting at the IP address level. In addition, in June 2020, we were notified of an unauthorized third party breach of our Dave database. The third party was able to access to Dave’s system by breaching the system of one of Dave’s third party service providers. The attacker was able to download a large data set, including encrypted social security numbers for some Members; however, there was no evidence that unauthorized transactions were made or advances requested on our platform, nor do we believe that the third party gained access to decryption keys or was otherwise able to decrypt encrypted information. The May 2020 and June 2020 incidents are collectively referred to herein as the "2020 Incidents." We took remedial measures, including the engagement of an outside security consultant to monitor for ongoing dark web activity and to conduct a security audit and incident investigation, and notified relevant parties as required under applicable law and agreements. As a result of the 2020 Incidents, we are in the process of settling a purported class action in California for approximately $3.1 million and we settled individual claims outside of California for approximately $4.4 million. See Item 1. Legal Proceedings. In addition, in 2024, one of our third-party service providers experienced a data breach that resulted in improper disclosure of certain of our Members’ information. As we have increased our Member base and our brand has become more widely known and recognized, third parties may continue to seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our Members’ data.

Previous wording

If our banking partner or other strategic partners were to conclude that our systems and security policies and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business could be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of nonpublic personal information of our Members that we store, we could be liable to the partner for their losses and related expenses.

Current wording

If our banking partner or other strategic partners were to conclude that our systems and security policies and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business could be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of non-public personal information of our Members that we store, we could be liable to the partner for their losses and related expenses.

Previous wording

We are subject to the regulatory and enforcement authority of the CFPB, which oversees compliance with federal consumer financial protection laws. In addition, our partnership with Evolve is subject to the supervisory authority of the Federal Reserve, which is Evolve’s primary federal bank regulator. The CFPB has broad enforcement powers, and upon determining a violation of applicable law has occurred can order, among other things, rescission or reformation of contracts, the refund of moneys, restitution, disgorgement or compensation for unjust enrichment, the payment of damages or other monetary relief, public notifications regarding violations, limits on activities or functions, remediation of practices, external compliance monitoring and civil money penalties. The cost of responding to investigations can be substantial and an adverse resolution to an investigation, including a consent order or other settlement, may have a material adverse effect on our business, financial position, results of operations and future prospects.

Current wording

We are subject to the regulatory and enforcement authority of the Consumer Financial Protection Bureau (“CFPB”), which oversees compliance with federal consumer financial protection laws. In addition, our partnership with Evolve is subject to the supervisory authority of the Federal Reserve, which is Evolve’s primary federal bank regulator. The CFPB has broad enforcement powers, and upon determining a violation of applicable law has occurred can order, among other things, rescission or reformation of contracts, the refund of moneys, restitution, disgorgement or compensation for unjust enrichment, the payment of damages or other monetary relief, public notifications regarding violations, limits on activities or functions, remediation of practices, external compliance monitoring and civil money penalties. The cost of responding to investigations can be substantial and an adverse resolution to an investigation, including a consent order or other settlement, may have a material adverse effect on our business, financial position, results of operations and future prospects.

Previous wording

Certain states have adopted laws regulating and requiring licensing, registration, notice filing, or other approval by parties that engage in certain activities regarding consumer finance transactions. We have also received inquiries from state regulatory agencies regarding requirements to obtain licenses from or register with those states, including in states where we have determined that we are not required to obtain such a license or be registered with the state, and we expect to continue to receive such inquiries. The application of certain consumer financial licensing laws to our platform and the related activities it performs is not always clear, and regulatory agencies may not agree with our determinations on the applicability of such laws to us. In addition, state licensing requirements may evolve over time, including, in particular, recent trends in legislation seeking to impose licensing requirements and regulation of parties engaged in business to consumer advance products such as ExtraCash. For example, in 2023, the banking regulators in Connecticut and Maryland issued guidance (and in the case of Maryland, a regulatory change) (collectively, “State Regulatory Changes”) indicating that traditional “earned wage access” products would, under certain circumstances, be considered small loans under the state lending laws, and that optional fees and tips, under certain circumstances, would be finance charges for purposes of calculating the interest rate under the state’s applicable usury limit. These State Regulatory Changes would subject those covered by them to licensure and limitations or prohibitions on certain charges. Although we do not believe that our ExtraCash overdraft product offered through Evolve is covered by the State Regulatory Changes, we have recently received separate inquiries from the Connecticut and Maryland banking regulators as to whether the ExtraCash product is subject to the State Regulatory Changes, as well as a subpoena from the Maryland Attorney General requesting information regarding any earned wage access and related products that we offer in the state of Maryland. Although we believe that our practices and products offered at all times in Maryland and Connecticut have been in compliance with applicable law, the defense or resolution of these matters could involve significant monetary costs or penalties and have a significant impact on our financial results and operations.

Current wording

Certain states have adopted laws regulating and requiring licensing, registration, notice filing, or other approval by parties that engage in certain activities regarding consumer finance transactions. We have also received inquiries from state regulatory agencies regarding requirements to obtain licenses from or register with those states, including in states where we have determined that we are not required to obtain such a license or be registered with the state, and we expect to continue to receive such inquiries. The application of certain consumer financial licensing laws to our platform and the related activities it performs is not always clear, and regulatory agencies may not agree with our determinations on the applicability of such laws to us. In addition, state licensing requirements may evolve over time, including, in particular, recent trends in legislation seeking to impose licensing requirements and regulation of parties engaged in the business of offering "earned wage access" products to consumers. For example, in 2023, the banking regulators in Connecticut and Maryland issued guidance (and in the case of Maryland, a regulatory change) (collectively, “State Regulatory Changes”) indicating that traditional “earned wage access” products would, under certain circumstances, be considered small loans under the state lending laws, and that optional fees and tips, under certain circumstances, would be finance charges for purposes of calculating the interest rate under the state’s applicable usury limit. These State Regulatory Changes would subject those covered by them to licensure and limitations or prohibitions on certain charges. Although we do not believe that our ExtraCash overdraft product offered through Evolve is covered by the State Regulatory Changes, we have recently received separate inquiries from the Connecticut and Maryland banking regulators as to whether the ExtraCash product is subject to the State Regulatory Changes, as well as a subpoena from the Maryland Attorney General requesting information regarding any earned wage access and related products that we offer in the state of Maryland. Although we believe that our practices and products offered at all times in Maryland and Connecticut have been in compliance with applicable law, the defense or resolution of these matters could involve significant monetary costs or penalties and have a significant impact on our financial results and operations.

Previous wording

If we were found to be in violation of applicable state licensing or other requirements by a court or a state, federal, or local enforcement agency, or agree to resolve such concerns by voluntary agreement, we could be subject to or agree to pay fines, damages, injunctive relief (including required modification or discontinuation of our business in certain areas), criminal penalties, and other penalties or consequences, and the advances facilitated through our platform could be rendered void in whole or in part, any of which could have an adverse effect on our business, results of operations, and financial condition. For example, we have received and responded to inquiries from various states, in each case regarding whether the advance products we offer in those states should subject us to state licensing and related requirements. In December 2021, we entered into a Memorandum of Understanding (“MOU”) with the California Department of Financial Protection and Innovation (“CA DFPI”). The MOU requires us to provide the CA DFPI with certain information as requested by the CA DFPI and adhere to certain best practices in connection with our ExtraCash advance product (including certain disclosures related to us not being licensed by the CA DFPI).

Current wording

If we were found to be in violation of applicable state licensing or other requirements by a court or a state, federal, or local enforcement agency, or agree to resolve such concerns by voluntary agreement, we could be subject to or agree to pay fines, damages, injunctive relief (including required modification or discontinuation of our business in certain areas), criminal penalties, and other penalties or consequences, and the ExtraCash receivables facilitated through our platform could be rendered void in whole or in part, any of which could have an adverse effect on our business, results of operations, and financial condition. Additionally, in December 2021, we entered into a Memorandum of Understanding (“MOU”) with the California Department of Financial Protection and Innovation (“CA DFPI”). The MOU required us to provide the CA DFPI with certain information as requested by the CA DFPI and adhere to certain practices in connection with our prior advance product (including certain disclosures related to us not being licensed by the CA DFPI). The CA DFPI finalized a new California Consumer Finance Protection Law regulation, effective February 15, 2025, which requires providers of income-based advances (and other providers) to register with the DFPI (the "DFPI Regulation.") The DFPI Regulation has an exemption for bank-issued products such as ExtraCash. The MOU will terminate on the DFPI Regulation's effective date. It is possible that the DFPI may not agree with the Company's interpretation of the DFPI Regulation and if we were found to be in violation of the DFPI Regulation, we could be subject to fines, damages, injunctive relief, and other penalties or consequences.