Oportun Financial Corp

Previous wording

As of June 30, 2026, we relied on Pathward to originate a substantial portion of our loan originations, with the remaining loans being originated directly by us under our lending and servicing licenses across 2 states in the United States. In the three months ended June 30, 2026 and 2025, Pathward originated approximately 99% and 97% of aggregate personal loan originations, respectively.

Current wording

As of September 30, 2026, we relied on Pathward to originate a substantial portion of our loan originations, with the remaining loans being originated by Column or directly by us under our lending licenses in the United States. In the three months ended September 30, 2026 and 2025, Pathward originated approximately 95% and 99% of aggregate personal loan originations, respectively.

Previous wording

In 2025, we entered into an amended and restated program agreement to extend our partnership with Pathward through 2029, which replaced the prior agreement in its entirety and governs the ongoing terms of our relationship. The amended and restated program agreement has an initial term of four years and will automatically renew for successive two-year periods following the initial four-year term, unless either party provides notice of its intent to not renew.

Current wording

In August 2025, we entered into an amended and restated program agreement with Pathward, effective August 11, 2025, which replaced the prior agreement in its entirety and extended our partnership through August 2029. The agreement has an initial term of four years and will automatically renew for successive two-year periods unless either party provides at least 180 days’ notice of its intent not to renew. On June 30, 2026, we entered into a program agreement with Column with an initial four-year term through June 30, 2030. The Column agreement will automatically renew for successive one-year periods unless either party provides at least 180 days’ notice of its intent not to renew. Both agreements are subject to earlier termination under specified circumstances.

Previous wording

We or Pathward may terminate our arrangement immediately upon a material breach by the other party and failure to cure such breach within a cure period, if any representations or warranties are found to be false and such error is not cured within a cure period, bankruptcy or insolvency of either party, receipt of an order or judgment by a governmental entity, a material adverse effect, or a change of control. If our bank partnership arrangement with Pathward were to be suspended or limited, including a reduction in the volume of loans that Pathward chooses to originate, or if Pathward ceased its operations or otherwise terminated its relationship with us, our business, financial condition and results of operations would be adversely affected. If we need to enter into alternative arrangements with a different bank to replace or supplement our existing arrangement, we may not be able to negotiate a comparable alternative arrangement in a timely manner or at all and transitioning loan originations to a new bank may result in delays in the issuance of new loans. In addition, if we are unable to enter into an alternative arrangement with a different bank to fully replace or supplement our relationship with Pathward, we would potentially need to obtain additional state licenses to enable us to originate loans directly in the states where Pathward originates loans, as well as comply with other state and federal laws, which would be costly and time consuming, and there can be no assurances that any such licenses could be obtained in a timely manner or at all. For a further discussion of the risks and regulations applicable to our bank partnership with Pathward, see “Risk Factors—Our bank partnership products may lead to regulatory risk and may increase our regulatory burden, —We are, and intend in the future to continue, expanding into new geographic regions, and our failure to comply with applicable laws or regulations, or accurately predict demand or growth, related to these geographic regions could have an adverse effect on our business, —Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability.”

Current wording

If either of our bank partnership arrangements were to be suspended or limited, including a reduction in the volume of loans that either bank partner chooses to originate, or if either bank partner ceased its operations or otherwise terminated its relationship with us, our business, financial condition and results of operations would be adversely affected. We may not be able to transition the affected originations to our other bank partner on a timely basis or at all. If we need to enter into alternative arrangements with a different bank to replace or supplement our existing arrangements, we may not be able to negotiate a comparable alternative arrangement in a timely manner or at all, and transitioning loan originations to a new bank may result in delays in the issuance of new loans. In addition, if we are unable to enter into an alternative arrangement with a different bank to fully replace or supplement the affected relationship, we would potentially need to obtain additional state licenses to enable us to originate loans directly in the states where the affected bank partner originates loans, as well as comply with other state and federal laws, which would be costly and time consuming, and there can be no assurances that any such licenses could be obtained in a timely manner or at all. For a further discussion of the risks and regulations applicable to our bank partnerships, see “Risk Factors—Our bank partnership products may lead to regulatory risk and may increase our regulatory burden, —We are, and intend in the future to continue, expanding into new geographic regions, and our failure to comply with applicable laws or regulations, or accurately predict demand or growth, related to these geographic regions could have an adverse effect on our business, —Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability.”

Previous wording

In particular, it is important that we continue to ensure that our members with loans remain loyal to us and we continue to extend loans to members who have successfully repaid their previous loans. As of June 30, 2026 and 2025, members with repeat loans comprised 80% and 77%, respectively, of our Owned Principal Balance at End of Period. If our repeat loan rates decline, we may not realize consistent or improved operating results from our existing member base.

Current wording

In particular, it is important that we continue to ensure that our members with loans remain loyal to us and we continue to extend loans to members who have successfully repaid their previous loans. As of September 30, 2026 and 2025, members with repeat loans comprised 82% and 76%, respectively, of our Owned Principal Balance at End of Period. If our repeat loan rates decline, we may not realize consistent or improved operating results from our existing member base.

Previous wording

We use estimates and assumptions in determining the fair value of our loans receivable held for investment and asset-backed notes. Our Loans Receivable at Fair Value represented 87% of our total assets and our Asset-backed notes at Fair Value represented 5% of our total liabilities as of June 30, 2026. The fair value of our loans receivable held for investment are determined using Level 3 inputs and the fair value of our asset-backed notes are determined using Level 2 inputs. Changes to these inputs could significantly impact our fair value measurements. Valuations are highly dependent upon the reasonableness of our assumptions and the predictability of the relationships that drive the results of our valuation methodologies. In addition, a variety of factors such as changes in the interest rate environment and the credit markets, changes in average life, higher than anticipated delinquency and default levels or financial market illiquidity, may ultimately affect the fair values of our loans receivable and asset-backed notes. Material differences in these ultimate values from those determined based on management’s estimates and assumptions may require us to adjust the value of certain assets and liabilities, including in a manner that is not comparable to others in our industry, which could adversely affect our results of operations.

Current wording

We use estimates and assumptions in determining the fair value of our loans receivable held for investment and asset-backed notes. Our Loans Receivable at Fair Value represented 87% of our total assets and our Asset-backed notes at Fair Value represented 3% of our total liabilities as of September 30, 2026. The fair value of our loans receivable held for investment are determined using Level 3 inputs and the fair value of our asset-backed notes are determined using Level 2 inputs. Changes to these inputs could significantly impact our fair value measurements. Valuations are highly dependent upon the reasonableness of our assumptions and the predictability of the relationships that drive the results of our valuation methodologies. In addition, a variety of factors such as changes in the interest rate environment and the credit markets, changes in average life, higher than anticipated delinquency and default levels or financial market illiquidity, may ultimately affect the fair values of our loans receivable and asset-backed notes. Material differences in these ultimate values from those determined based on management’s estimates and assumptions may require us to adjust the value of certain assets and liabilities, including in a manner that is not comparable to others in our industry, which could adversely affect our results of operations.

Previous wording

Market interest rate changes have had, and may continue to have, an adverse effect on our business forecasts and expectations and are highly sensitive to many macroeconomic factors beyond our control, such as the imposition of tariffs and non-tariff trade barriers, inflation, recession, the state of the credit markets, global economic disruptions, unemployment and the fiscal and monetary policies of the federal government and its agencies. Factors outside our control, including interest rate changes and widening credit spreads, have required, and may continue to require us to make adjustments to the fair value of our loans receivable held for investment or our asset-backed notes, which may in turn adversely affect our results of operations or lead to volatility in our Net Revenue. For example, elevated interest rates decrease the fair value of our loans receivable held for investment, which decreases Net Revenue, but also decreases the fair value of our asset-backed notes, which increases Net Revenue. Because the duration and fair value of our loans and asset-backed notes are different, the respective changes in fair value may not fully offset each other resulting in a negative impact on Net Revenue and increasing the volatility of our results of operations. Reductions in our interest rate spread have had and could continue to have an adverse effect on our business, results of operations, cash flows, and financial condition. We do not currently hedge our interest rate exposure associated with our debt financing or fair market valuation of our loans.

Current wording

Market interest rate changes have had, and may continue to have, an adverse effect on our business forecasts and expectations and are highly sensitive to many macroeconomic factors beyond our control, such as the imposition of tariffs and non-tariff trade barriers, inflation, recession, the state of the credit markets, global economic disruptions, unemployment and the fiscal and monetary policies of the federal government and its agencies. Factors outside our control, including interest rate changes and widening credit spreads, have required, and may continue to require us to make adjustments to the fair value of our loans receivable held for investment or our asset-backed notes, which may in turn adversely affect our results of operations or lead to volatility in our Net Revenue. For example, elevated interest rates decrease the fair value of our loans receivable held for investment, which decreases Net Revenue. Reductions in our interest rate spread have had and could continue to have an adverse effect on our business, results of operations, cash flows, and financial condition. We do not currently hedge our interest rate exposure associated with our debt financing or fair market valuation of our loans.

Previous wording

Negative publicity about our industry or our company, including the terms of the consumer loans, effectiveness of our proprietary credit risk models, privacy and security practices, originations, marketing, servicing and collections, use of A.I., and other business practices or initiatives, litigation, regulatory compliance and the experience of members, even if inaccurate, could adversely affect our reputation and the confidence in our brands and business model or lead to changes in our business practices. We regularly engage with media outlets and consumer advocates, taking their feedback into account as we assess and refine our business practices and policies; based on those interactions, we have made and may continue to make adjustments to better serve our members and stakeholders. Despite our responsiveness to the inquiries, certain media outlets and consumer advocates chose to and have continued to highlight the very past practices that we had already modified. The proliferation of social media may increase the likelihood that negative public opinion will impact our reputation and business. Our reputation is very important to attracting new members and retaining existing members. While we believe that we have a good reputation and that we provide members with a superior experience, there can be no assurance that we will continue to maintain a good relationship with members.

Current wording

Negative publicity about our industry or our company, including the terms of the consumer loans, effectiveness of our proprietary credit risk models, privacy and security practices, originations, marketing, servicing and collections, use of A.I., and other business practices or initiatives, litigation, regulatory compliance and the experience of members, even if inaccurate, could adversely affect our reputation and the confidence in our brands and business model or lead to changes in our business practices. Certain loans originated by Column and purchased by us bear APRs above 36%, which could subject us to increased scrutiny from consumer advocates, regulators and others and adversely affect our reputation and business. We regularly engage with media outlets and consumer advocates, taking their feedback into account as we assess and refine our business practices and policies; based on those interactions, we have made and may continue to make adjustments to better serve our members and stakeholders. Despite our responsiveness to the inquiries, certain media outlets and consumer advocates chose to and have continued to highlight the very past practices that we had already modified. The proliferation of social media may increase the likelihood that negative public opinion will impact our reputation and business. Our reputation is very important to attracting new members and retaining existing members. While we believe that we have a good reputation and that we provide members with a superior experience, there can be no assurance that we will continue to maintain a good relationship with members.

Previous wording

Harm to our reputation can also arise from many other sources, including employee or former employee misconduct, misconduct by outsourced service providers or other counterparties, failure by us or our partners to meet minimum standards of service and quality, and inadequate protection of member information and compliance failures and claims. Our reputation may also be harmed if we fail to maintain our certification as a Community Development Financial Institution.

Current wording

Harm to our reputation can also arise from many other sources, including employee or former employee misconduct, misconduct by outsourced service providers or other counterparties, failure by us or our partners to meet minimum standards of service and quality, and inadequate protection of member information and compliance failures and claims.

Previous wording

Our future success significantly depends on the continued service and performance of our key management personnel. Competition for these employees is intense and we may not be able to replace, attract and retain key personnel. We do not maintain key-man insurance for our senior management team. The loss of the service of our senior management team or key team members, and the process to replace any of them, or the inability to attract additional qualified personnel as needed, all of which would involve significant time and expense, could harm our business and impact our ability to recruit and retain personnel. Our key management personnel are at-will employees and, therefore, they could terminate their employment with us at any time. Competition for executive management is high, and it may take months to find a candidate that meets our requirements. Such recruiting efforts could divert the attention of our existing management team. Accordingly, the loss of one or more of our key management personnel could have an adverse effect on our business. If the management team, including any new hires that we make, fails to work together effectively and to execute our plans and strategies on a timely basis then our business and future growth prospects could be harmed.

Current wording

We have experienced changes in several senior management positions during 2026, including, but not limited to, the appointment of a new Chief Executive Officer, Chief Financial Officer and Chief Risk Officer. Leadership transitions involve inherent risks, and our success depends in part on effectively integrating our new executives and maintaining continuity in our operations and execution of our business strategy. Our future success significantly depends on the continued service and performance of our key management personnel. Competition for these employees is intense and we may not be able to replace, attract and retain key personnel. We do not maintain key-man insurance for our senior management team. The loss of the service of our senior management team or key team members, and the process to replace any of them, or the inability to attract additional qualified personnel as needed, all of which would involve significant time and expense, could harm our business and impact our ability to recruit and retain personnel. Our key management personnel are at-will employees and, therefore, they could terminate their employment with us at any time. Competition for executive management is high, and it may take months to find a candidate that meets our requirements. Such recruiting efforts could divert the attention of our existing management team. Accordingly, the loss of one or more of our key management personnel could have an adverse effect on our business. If the management team, including our recently appointed executives and any future hires, fails to work together effectively and to execute our plans and strategies on a timely basis then our business and future growth prospects could be harmed.

Previous wording

Changes in our executive management team resulting from the hiring or departure of executives, including key personnel or members of senior management, could disrupt our operations and impact our ability to attract, integrate, retain and motivate employees, and have an adverse effect on our business. In particular, it could adversely impact our internal control environment, divert employee and management attention from ongoing business activities and strategic objectives, negatively affect employee morale and retention, and damage company culture. There can be no assurance that any of our other key personnel will remain with us, that the costs associated with retaining current key personnel and hiring new key personnel will be favorable or acceptable to us or that new key personnel will be as successful as their predecessors.

Current wording

These recent changes and any future changes in our executive management team, could disrupt our operations and impact our ability to attract, integrate, retain and motivate employees, and have an adverse effect on our business. In particular, such changes could adversely impact our internal control environment, divert employee and management attention from ongoing business activities and strategic objectives, negatively affect employee morale and retention, and damage company culture. There can be no assurance that any of our key personnel will remain with us, that the costs associated with retaining current key personnel and hiring new key personnel will be favorable or acceptable to us or that new key personnel will successfully perform their responsibilities and execute our business strategy.

Previous wording

We are increasingly dependent on information systems, services and infrastructure to operate our business. In the ordinary course of our business, we collect, process, transmit and store large amounts of sensitive information, including personal information, credit information and other sensitive data of our members and potential members. It is critical that we do so in a manner designed to maintain the confidentiality, integrity and availability of such sensitive information. Our reputation and ability to attract, retain and serve our members is dependent upon the reliable performance and security of our technology infrastructure and those of third parties that we utilize in our operations. These systems may be subject to damage or interruption from, among other things, earthquakes, adverse weather conditions, other natural disasters, terrorist attacks, rogue employees, power loss, telecommunications failures, technological errors or outages, and cybersecurity risks. Like other financial and technology services firms, we have been and continue to be the subject of actual or attempted unauthorized access, mishandling or misuse of information, computer viruses, ransomware or other malware, and cyber-attacks that could obtain or disclose confidential information, destroy data, disrupt or degrade service, threaten the integrity and availability of our systems, distributed denial of service attacks, social engineering, security breaches and incidents, and infiltration, exfiltration or other similar events. Our adoption of remote working arrangements for our corporate and many of our contact center employees may result in increased consumer or employee privacy, security, and fraud concerns arising from the increased electronic transfer and other online activity. For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities and such security systems may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations. Techniques used in cybersecurity attacks to obtain unauthorized access, disable or sabotage information technology systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts in Ukraine and escalation of hostilities in the Middle East. We have seen, and will continue to see, industry-wide vulnerabilities, which could affect our or other parties’ systems. We also have incorporated A.I. technologies into our platform, and may continue to incorporate additional A.I. technologies into our platform in the future. Our use of A.I. technologies may create additional cybersecurity risks or increase cyb…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We are increasingly dependent on information systems, services and infrastructure to operate our business. In the ordinary course of our business, we collect, process, transmit and store large amounts of sensitive information, including personal information, credit information and other sensitive data of our members and potential members. It is critical that we do so in a manner designed to maintain the confidentiality, integrity and availability of such sensitive information. Our reputation and ability to attract, retain and serve our members is dependent upon the reliable performance and security of our technology infrastructure and those of third parties that we utilize in our operations. These systems may be subject to damage or interruption from, among other things, earthquakes, adverse weather conditions, other natural disasters, terrorist attacks, rogue employees, power loss, telecommunications failures, technological errors or outages, and cybersecurity risks. Like other financial and technology services firms, we have been and continue to be the subject of actual or attempted unauthorized access, mishandling or misuse of information, computer viruses, ransomware or other malware, and cyber-attacks that could obtain or disclose confidential information, destroy data, disrupt or degrade service, threaten the integrity and availability of our systems, distributed denial of service attacks, social engineering, security breaches and incidents, and infiltration, exfiltration or other similar events. Our adoption of remote working arrangements for our corporate and many of our contact center employees may result in increased consumer or employee privacy, security, and fraud concerns arising from the increased electronic transfer and other online activity. For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities and such security systems may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations. Techniques used in cybersecurity attacks to obtain unauthorized access, disable or sabotage information technology systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts in Ukraine and escalation of hostilities in the Middle East. We have incorporated A.I. technologies into our platform and may continue to incorporate additional A.I. technologies into our platform in the future. Further, recent industry developments involving critical vulnerabilities in widely used software illustrate the potential for A.I. technologies to accelerate the discovery of previously unknown vulnerabilities and…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

As of June 30, 2026, 35.7%, 26.6%, 12.4%, 6.7% and 4.9% of our Owned Principal Balance at End of Period related to members from California, Texas, Florida, Illinois and New Jersey, respectively. If any of the events noted in these risk factors were to occur in or have a disproportionate impact in regions where we operate or plan to commence operations, it may negatively affect our business in many ways, including increased delinquencies and loan losses or a decrease in future originations.

Current wording

As of September 30, 2026, 35.2%, 26.2%, 12.6%, 6.7% and 5.0% of our Owned Principal Balance at End of Period related to members from California, Texas, Florida, Illinois and New Jersey, respectively. If any of the events noted in these risk factors were to occur in or have a disproportionate impact in regions where we operate or plan to commence operations, it may negatively affect our business in many ways, including increased delinquencies and loan losses or a decrease in future originations.

Previous wording

In some cases, third-party vendors are the sole source, or one of a limited number of sources, of the services they provide to us. Most of our vendor agreements are terminable on little or no notice, and if our current vendors were to stop or were unable to continue providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner on acceptable terms or at all. If any third-party vendor fails to provide the services we require, due to factors outside our control, we could be subject to regulatory enforcement actions, suffer economic and reputational harm and incur significant costs to resolve any such disruptions in service. For a further discussion of the risks applicable to our partnership with Pathward, see “Risk Factors—We currently rely on Pathward to originate a substantial portion of our loans. If our relationship with Pathward terminates, or if Pathward were to suspend, limit, or cease its operations or loan origination activities for any reason, and we are unable to engage another originating bank partner on a timely basis or at all, our business, results of operations and financial condition would be materially and adversely affected.”

Current wording

In some cases, third-party vendors are the sole source, or one of a limited number of sources, of the services they provide to us. Most of our vendor agreements are terminable on little or no notice, and if our current vendors were to stop or were unable to continue providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner on acceptable terms or at all. If any third-party vendor fails to provide the services we require, due to factors outside our control, we could be subject to regulatory enforcement actions, suffer economic and reputational harm and incur significant costs to resolve any such disruptions in service. For a further discussion of the risks applicable to our bank partnerships, see “Risk Factors—We currently rely on arrangements with two bank partners to originate a substantial portion of our loans. If our relationship with either bank partner terminates, or if either bank partner were to suspend, limit, or cease its operations or loan origination activities for any reason, and we are unable to replace the affected originations on a timely basis or at all, our business, results of operations and financial condition would be materially and adversely affected.”

Previous wording

As of June 30, 2026, we had 1,528 employees in Mexico, including employees related to our two contact centers. These employees provide certain English/Spanish bilingual support related to member-facing contact center activities, administrative and technology support of the contact centers and back-office support services. In addition, we have a technology development center in India, where we had 200 employees as of June 30, 2026. We have also previously engaged vendors that utilized employees or contractors based outside of the U.S. These international activities are subject to inherent risks that are beyond our control, including:

Current wording

As of September 30, 2026, we had 1,538 employees in Mexico, including employees related to our two contact centers. These employees provide certain English/Spanish bilingual support related to member-facing contact center activities, administrative and technology support of the contact centers and back-office support services. In addition, we have a technology development center in India, where we had 201 employees as of September 30, 2026. We have also previously engaged vendors that utilized employees or contractors based outside of the U.S. These international activities are subject to inherent risks that are beyond our control, including:

Previous wording

We collect, store, use, disclose, and otherwise process a large volume of personal information about individuals (including members and employees). New laws and regulations concerning the processing of personal information continue to be vigorously debated and enacted at all levels of government across the United States and around the globe while existing laws, such as the Gramm-Leach-Bliley Act (“GLBA”) are being amended or reinterpreted to account for the rapidly evolving data economy. The California Consumer Privacy Act (“CCPA”), as augmented and otherwise amended by the California Privacy Rights Act of 2020, imposes significant requirements on businesses processing consumer personal information, principally around enabling and honoring consumer choices related to such processing. Regulations under the CCPA have now been finalized addressing, among other matters, the use of automated decision-making technology (“ADMT”) in “significant decisions”. The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the GLBA. In some cases, these laws also contain broader exemptions for entities, such as financial institutions, that are subject to the GLBA; however, these exemptions may not exempt us completely from these laws, and their scope and interpretation remain subject to uncertainty. Further, future laws may not include such exemptions. Violations of the CCPA can result in civil penalties assessed by the California Attorney General or the California Privacy Protection Agency and individual plaintiffs may pursue statutory damages in a private right of action for certain data breaches. Several U.S. states have already followed California’s lead in enacting comprehensive privacy legislation and others are likely to do so in the future. These developments reflect the continued evolution of state privacy regulation and the potential for expanding obligations on businesses that use consumer data. At the federal level, regulators, including the CFPB and FTC, have adopted, or are considering adopting, laws and regulations concerning personal information and data privacy and security. The FTC, for example, released its updated Standards for Safeguarding Customer Information (Safeguards Rule), effective June 9, 2023, which raises the bar for covered financial institutions’ information security programs through proscriptive requirements for accountability, oversight, risk assessments, encryption, and multi-factor authentication to protect all forms of customer information. Further, on October 22, 2024, the CFPB finalized the Section 1033 Rule on Personal Financial Data Rights, which requires certain financial institutions, and any party who controls or possesses information concerning a covered financial product or service, to provide financial data to consumers in a standardized electronic format through a consumer interface and limits collecting and maintaining data only as ne…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We collect, store, use, disclose, and otherwise process a large volume of personal information about individuals (including members and employees). New laws and regulations concerning the processing of personal information continue to be vigorously debated and enacted at all levels of government across the United States and around the globe while existing laws, such as the Gramm-Leach-Bliley Act (“GLBA”) are being amended or reinterpreted to account for the rapidly evolving data economy. The California Consumer Privacy Act (“CCPA”), as augmented and otherwise amended by the California Privacy Rights Act of 2020, imposes significant requirements on businesses processing consumer personal information, principally around enabling and honoring consumer choices related to such processing. Regulations under the CCPA have now been finalized addressing, among other matters, the use of automated decision-making technology (“ADMT”) in “significant decisions,” and a new Colorado law addressing ADMT is also scheduled to take effect January 1, 2027. The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the GLBA. In some cases, these laws also contain broader exemptions for entities, such as financial institutions, that are subject to the GLBA; however, these exemptions may not exempt us completely from these laws, and their scope and interpretation remain subject to uncertainty. Further, future laws may not include such exemptions. Violations of the CCPA can result in civil penalties assessed by the California Attorney General or the California Privacy Protection Agency and individual plaintiffs may pursue statutory damages in a private right of action for certain data breaches. Several U.S. states have already followed California’s lead in enacting comprehensive privacy legislation and others are likely to do so in the future. These developments reflect the continued evolution of state privacy regulation and the potential for expanding obligations on businesses that use consumer data. At the federal level, regulators, including the CFPB and FTC, have adopted, or are considering adopting, laws and regulations concerning personal information and data privacy and security. The FTC, for example, released its updated Standards for Safeguarding Customer Information (Safeguards Rule), effective June 9, 2023, which raises the bar for covered financial institutions’ information security programs through proscriptive requirements for accountability, oversight, risk assessments, encryption, and multi-factor authentication to protect all forms of customer information. Further, on October 22, 2024, the CFPB finalized the Section 1033 Rule on Personal Financial Data Rights, which requires certain financial institutions, and any party who controls or possesses information concerning a covered financial product or service, to provide financial data to consumers in a standardized electronic …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our amended and restated certificate of incorporation authorizes us to issue shares of common stock authorized but unissued and rights relating to common stock for the consideration and on the terms and conditions established by our Board in its sole discretion, whether in connection with acquisitions or otherwise. We have authorized a total of 19,222,629 shares for issuance under our 2019 Equity Incentive Plan with 10,782,817 shares, net of vested and exercised shares, remaining available for issuance, 3,076,776 shares for issuance under our 2019 Employee Stock Purchase Plan, and 2,305,000 shares authorized for issuance under our Amended and Restated 2021 Inducement Equity Incentive Plan with 1,784,444 shares, net of vested and exercised shares, remaining for issuance, each subject to adjustment in certain events. Any common stock that we issue, including under our existing equity incentive plans or other equity incentive plans that we may adopt in the future, or in connection with any acquisitions, financings, investments or otherwise, could dilute your percentage ownership.

Current wording

Our amended and restated certificate of incorporation authorizes us to issue shares of common stock authorized but unissued and rights relating to common stock for the consideration and on the terms and conditions established by our Board in its sole discretion, whether in connection with acquisitions or otherwise. We have authorized a total of 19,222,629 shares for issuance under our 2019 Equity Incentive Plan with 10,687,987 shares, net of vested and exercised shares, remaining available for issuance, 3,076,776 shares for issuance under our 2019 Employee Stock Purchase Plan, and 2,305,000 shares authorized for issuance under our Amended and Restated 2021 Inducement Equity Incentive Plan with 1,749,624 shares, net of vested and exercised shares, remaining for issuance, each subject to adjustment in certain events. Any common stock that we issue, including under our existing equity incentive plans or other equity incentive plans that we may adopt in the future, or in connection with any acquisitions, financings, investments or otherwise, could dilute your percentage ownership.