Fold Holdings, Inc.

Cybersecurity Risk Management and Strategy

We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our board of directors, our audit and compliance committee (“Audit Committee”), and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

Our cybersecurity risk management program includes:

•

physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and vendors, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

•

a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;

•

a security team responsible for managing our cybersecurity risk assessment processes and security controls;

•

theuse of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls;

•

annual cybersecurity and privacy training of employees, including incident response personnel and senior management; and

•

a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

Over the past fiscal year, we havenot identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled “Risk Factors” in Part I, Item 1A of this Annual Report on Form 10-K.

Cybersecurity Governance

With oversight from our board of directors, the Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management’s strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.

The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments. Theboard of directors also receives updates on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our board of directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks as part of the continuing education of our board of directors on topics that impact public companies.

Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment

Our Chief Technology Officer ("CTO") is primarily responsible for assessing and managing cybersecurity risks, including identifying internal and external threats, overseeing implementation of our information security program, and defining our multi-disciplinary, defense-in-depth strategy. The CTO is responsible for developing and maintaining information security policies, procedures, and programs, monitoring compliance across the organization, overseeing cybersecurity-related training, and triaging Security Events in coordination with Legal to determine whether they constitute Security Incidents requiring escalation. Our CTO, Tom Dickman, brings over a decade of technical and engineering expertise to this role. He has served as our CTO since August 2023 and previously as our Lead Software Engineer from June 2018 to November 2023. Prior to joining Fold, Mr. Dickman held roles as a Senior Software Engineer at RetailMeNot, Inc., and as a Software Engineer at Northrop Grumman Corporation. He holds a Bachelor of Science in Electrical and Electronics Engineering and a Master of Science in Computer Engineering, both from the University of Cincinnati.

Our CTO is informed about and monitors cybersecurity risks through our written Information Security Program, which includes regular risk assessments evaluating internal and external threats, annual (or more frequent) penetration testing of customer-accessible applications, and independent audits of related policies and procedures. We maintain a formal Incident Response Plan with four phases — detection and validation, investigation and containment, notification and communications, and post-incident analysis — under which security events are assessed for severity using a defined severity matrix and escalated to our cross-functional Incident Response Team as warranted.

Our CTO reports cybersecurity matters to the Board of Directors, including security breaches or violations.