Bakkt, Inc.

Investing in our securities involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and accompanying notes, before making a decision to invest in our securities. Our business, financial condition, results of operations or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material. If any of the risks actually occur, our business, financial condition, results of operations or prospects could be adversely affected. In that event, the trading price of our securities could decline, and you could lose part or all of your investment.

Our business is subject to numerous risks and uncertainties that you should consider before investing in our securities. These risks are described more fully below and include, but are not limited to, risks relating to the following:

Risks Related to Our Business, Finances and Operations

• Our business model is newly developed and may encounter additional risks and challenges as it grows.

• Our platform has been designed to meet the needs of our clients and customers, and as such we must continually invest in our platform to meet their evolving needs is being further developed as we look to grow our business.

• We have limited operating history and a history of operating losses.

• If we are unable to attract, retain or grow our relationships with our existing clients, our business, financial condition, results of operations and future prospects would be materially and adversely affected.

• Some of our current and prospective clients require the approval of their own regulators in order to deploy our solutions, and if they are unable to obtain those approvals on a timely basis, or at all, our results of operations and future prospects would be materially and adversely affected.

• A large percentage of our revenue is concentrated with a single client that has notified us it will not be renewing its agreement with us. The loss of this client will materially and adversely affect our business, financial condition, results of operations and future prospects. Moreover, because of our B2B2C go-to-market model, the loss of any client—regardless of the reason—increases the risk that the customers that originally emanated from that client will transition to another provider or stop doing business with us, which would harm our business.

• We maynot realize the anticipated benefits of past or future investments, strategic transactions, or acquisitions and integration of these acquisitions may disrupt our business and management.

•In the past, we have identified conditions and events that raised substantial doubt about our ability to continue as a going concern and it is possible that we may identify conditions and events in the future that raise substantial doubt about our ability to continue as a going concern.

Risks Related to Crypto

• Disruptions in the crypto market subject us to additional risks, including the risk that banks may notprovide banking services to us.

-32-

• There may be a perception among regulators and others that crypto is used to facilitate illegal activity such as fraud, money laundering, tax evasion and ransomware scams.

•Crypto custodial solutions and related technology, including our systems and custodial arrangements, are subject to risks related to a loss of funds due to theft, employee or vendor sabotage, security and cybersecurity risks, system failures and other operational issues the loss, destruction or other compromise of our private keys and a lack of sufficient insurance.

• Our failure to safeguard and manage our customers’ crypto could adversely impact our business, operating results, and financial condition.

•Crypto does not have extensive historical precedent and distributed ledger technology continues to rapidly evolve.

• We may encounter technical issues in connection with the integration of supported crypto assets and changes and upgrades to their underlying networks, which could adversely affect our business.

Risks Related to Regulation, Taxation and Laws

• We are subject to extensive government regulation, oversight, licensure and appraisals and our failure to comply could materially harm our business.

• The regulatory regimes governing blockchain technologies and crypto are uncertain and may change rapidly. New regulations or policies may alter or significantly adversely affect our business practices with respect to crypto assets, and we may need to adapt our business to regulatory change quickly to succeed.

• A crypto asset’s status as a “security” in any relevant jurisdiction is currently subject to a high degree of uncertainty, and if crypto assets on our platform are later determined to be securities, we may be subject to regulatory scrutiny, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition.

• We are subject to significant litigation risk and risk of regulatory liability and penalties. Any current or future litigation against us could be costly and time-consuming to defend.

Risks Related to Information Technology and Data

• Actual or perceived cyberattacks, security incidents, or breaches could result in serious harm to our reputation, business and financial condition.

Risks Related to Risk Management and Financial Reporting

• If we are unable to maintain effective internal controls over financial reporting, we may be unable to produce timely and accurate financial statements, which could have a material effect on our business.

Risks Related to Our Securities

• The trading market for our securities has in the past been and could in the future be impacted by market volatility. Stock run-ups, divergences in valuation ratios relative to those seen during traditional markets, high short interest or short squeezes, and strong and atypical retail investor interest in the markets may impact the demand for our securities.

Risks Related to Our Business, Finances and Operations

-33-

Our business model is newly developed and may encounter additional risks and challenges as it grows.

Our vision is that our clients will utilize our platform as the go-to solution enabling customers to transact in crypto and loyalty points. Most of the assets that we have incorporated and intend to incorporate into our platform in the future are already being handled by incumbent providers. There can be no assurance that our platform will gain the acceptance of clients or customers or generate the anticipated synergies. It is difficult to predict the preferences and requirements of clients or customers, and our platform, design and technology may not appeal to such clients or customers, or may be incompatible with new or emerging forms of crypto or related technologies. Failure to achieve acceptance would impede our ability to develop and sustain a commercial business.

We primarily generate revenue when customers transact in crypto and loyalty points on our platform. Our success depends on bringing on clients and on the transaction volume from customers. If we are not able to bring new clients onto the platform, many of whom will pay us subscription fees for our platform services, our revenue and business concern could be negatively impacted. Additionally, much of our future revenue depends on transaction fees earned from customers transacting in crypto and loyalty points and the margin we charge in connection with those transactions. If we are not able to continue to grow our base of clients, we will not be able to continue to grow our customer base, our revenues or our business, which could negatively impact our financial condition and results of operations and may cause us to be unable to continue as a going concern.

The attractiveness of our platform depends upon, among other things:

• the number and variety of assets and other capabilities in which customers can transact through our platform;

• our reputation, as well as clients’ and customers’ experience and satisfaction with, and trust and perception of, our platform;

• technological innovation;

• regulatory compliance and data security; and

• services and products offered by competitors.

Moreover, clients may choose to contract with other providers of services that are competitive with ours. If we fail to retain existing clients, attract new clients, or continually expand usage and transaction volume on our platform, our business, financial condition, results of operations and prospects will be materially and adversely affected.

We will have both increased financial and reputational risks if there is a failure to launch one or more features, or if the launch of a new feature is unsuccessful. Also, there can be no assurance that we will receive support from clients to launch features as planned or that we will operate as anticipated. We also are subject to requirements to obtain regulatory approvals, including, for example, to add new crypto assets, products, and functionalities to our platform, and may be required to obtain additional licenses and/or consultation with or approval of regulators to add, modify or discontinue certain aspects of our business model, which could lead to delays or other complexities in effectuating such changes and have a material adverse effect on our business and plan of operations.

Further, our business model entails numerous risks, including risks relating to our ability to:

• manage the complexity of our business model to stay current with the industry and new technologies;

• successfully enter new categories, markets and jurisdictions in which we may have limited or no prior experience;

-34-

• integrate into multiple distributed ledger technologies as they currently exist and as they evolve;

• successfully develop and integrate products, systems and personnel into our business operations;

• obtain and maintain required licenses and regulatory approvals for our business; and

• respond to, and comply with, the evolving regulatory landscape for crypto and crypto platforms.

For example, we plan to expand our platform to offer stablecoin-based payment service under the Cooperation Agreement with DTR. While we believe such expanded offerings will be beneficial in our attempts to attract and retain clients and to increase transaction volumes and assets under custody, the interest level of our clients and their customers in these offerings may be less than we expect or market adoption may be slower than we anticipate, any of which may be adverse to our business and prospects.

Our platform has been designed to meet the needs of our clients and customers, and as such we must continually invest in our platform to meet their evolving needs we look to grow our business. Any failure by us to successfully execute on the development of our platform would have an adverse effect on our business, results of operations and financial condition.

Our platform is in the early stages of release and will be further refined and developed, and certain areas of our platform are still under development and largely untested on a commercial scale. We are working to expand our service offerings, including, for example, utilizing BakktX technology for an institutionally-focused ECN. Our platform will require additional development in order to add all of the additional functionalities and features planned by our management and activate our service offerings. There can be no assurance that the additional functionalities and features currently planned for our platform will be successfully developed in a timely fashion or at all. The addition of functionalities to our platform may require regulatory approvals, may increase our regulatory obligations and the degree of regulatory scrutiny we face, and may make regulatory compliance more complex and burdensome. We will have both increased financial and reputational risks if there is a failure to launch one or more functionalities, or if the launch of a new functionality is unsuccessful. Also, there can be no assurance that we will receive the necessary regulatory approvals or support from clients to launch features as planned or that we will operate as anticipated. Any problems or delays that we encounter with the development or operation of our platform, including technical, legal and regulatory problems, could have a material adverse effect on our business, financial condition and results of operations.

We have a limited operating history and a history of operating losses, which make it difficult to forecast our future results of operations. Further, we have reduced, and may in the future further reduce, our operating expenses in the foreseeable future, and we may not achieve or sustain profitability to absorb our targeted expense base.

We were founded in 2018 and have experienced net losses in the periods from inception through December 31, 2024. For example, our revenue was $3,490.2 million and $780.1 million in the years ended December 31, 2024 and December 31, 2023, respectively, and we generated net losses of $103.5 million and $225.8 million in the years ended December 31, 2024 and December 31, 2023, respectively. You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. As a result of our limited operating history, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth. Prior to the Bakkt Crypto acquisition in April 2023, our historical revenue was achieved largely as the result of a white-labeled loyalty redemption product offered by the Bakkt Loyalty Solutions business, and therefore should not be considered indicative of our future performance.

Because of our limited operating history and the fact that our current and historical revenue prior to the acquisition of Bakkt Crypto was largely not derived from our current business model, our future revenue growth is difficult to predict. Even if we experience strong revenue growth, in future periods our revenue or revenue growth could decline for a number of reasons, including slowing demand for our platform, cyclicality in crypto trading

-35- activity, increased competition, changes to technology, a decrease in the growth of our overall market, or our failure, for any reason, to take advantage of growth opportunities. We have also encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described below. If our assumptions regarding these risks and uncertainties and our future revenue growth are incorrect or change, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, and our business could suffer.

Despite reducing operating expenses in 2024, we may not be able to achieve the operating expense levels that align with our revenues and may not achieve or, if achieved, maintain profitability. Furthermore, we intend to continue to invest significant resources to further develop our platform. If we are unable to achieve the revenue growth that we expect from these investments, further reduce our operating expenses, or achieve profitability, it would have an adverse effect on our financial condition and results of operations, and the value of our business and our securities may significantly decrease.

Substantially all of our net revenues each quarter come from transactions that occur during that quarter, which has resulted in, and may continue to result in, significant fluctuations in our operating results.

Our quarterly results, including revenue, expenses, consumer metrics and other key metrics, are derived from transactions that occur during that quarter. Accordingly, our quarterly results have fluctuated and are likely to continue to fluctuate significantly due to a variety of factors, some of which are outside of our control. For example, we saw a significant increase in crypto transactions in the fourth quarter of 2024 relative to prior periods. It is difficult for us to forecast accurately the level or source of our revenues, earnings and expenses, and the results for any one quarter are not necessarily an indication of future performance or expenses. Moreover, because of these fluctuations, our quarterly results may not fully reflect the underlying performance of our business. If our revenue, expenses, or key metrics in future quarters fall short of the expectations of our investors and financial analysts, the price of our securities could be adversely affected.

Other factors that may cause fluctuations in our quarterly results include:

• our ability to attract and retain clients and generate transaction volume from customers;

• market sentiment regarding cryptocurrencies;

• our ability to negotiate agreements with vendors, partners and service providers on terms that are favorable to us, if at all;

• transaction volume and mix;

• rates of repeat transaction and fluctuations in usage of our platform, including seasonality;

• the amount and timing of our expenses related to acquiring clients and customers and the maintenance and expansion of our business, operations and infrastructure;

• changes to our relationships with our clients;

• general economic, industry and market conditions;

• competitive dynamics in the industry in which we operate;

• the amount and timing of stock-based compensation expenses;

• network outages, cyberattacks, or other actual or perceived security incidents or breaches or data privacy violations;

-36-

• the cost and outcomes of existing or potential claims or litigation; and

• the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill from acquired technologies or businesses.

If we are unable to attract, retain or grow our relationships with our existing clients, our business, financial condition, results of operations and future prospects would be materially and adversely affected. Moreover, sales efforts to large clients involve risks that may not be present or that are present to a lesser extent with respect to sales to smaller organizations.

For our platform to be successful, we must continue our existing partnerships, and successfully develop new partnerships, with clients. Our ability to retain and grow our relationships with our clients depends on the willingness of those clients to establish a commercial relationship with us. If clients with whom we develop partnerships fail to market or do not effectively market our platform to their customers, or customers fail to adopt our platform through these marketing efforts in such numbers as we have projected, our customer acquisition costs may increase and our business, financial condition and results of operations may be adversely affected.

Sales to large clients involve risks that may not be present or that are present to a lesser extent with sales to smaller organizations, such as longer sales cycles, more complex requirements and substantial upfront sales costs. For example, large clients may require considerable time to evaluate and test our platform prior to making a decision, or may request pricing models that may decrease our potential margins. Several factors influence the length and variability of our sales cycle, including the need to educate potential clients about the uses and benefits of our platform, the discretionary nature of purchasing and budget cycles, and the competitive nature of evaluation and purchasing approval processes. In order for our sales efforts to large organizations to be successful, we often must be able to engage with senior officers of the organization. As a result, the length of our sales cycle, from identification of the opportunity to deal closure, may vary significantly for each client, with sales to large enterprises typically taking longer to complete. If we fail to effectively manage the risks associated with sales cycles and sales to large clients, our business, financial condition and results of operations may be adversely affected.

Moreover, when we execute an agreement with a client, we are still dependent on that client to deploy our platform. Larger clients, in particular, often delay deployment for a lengthy period of time after executing an agreement. Even when clients begin their integration into our platform, they do so on a limited basis while frequently requiring that we provide implementation services, which may include customization and controls that limit the functionality of our platform, and negotiate pricing discounts, which increases our upfront investment in the sales effort with no guarantee that sales to these clients will justify our upfront investment, which can be substantial. If a client delays deployment for lengthy periods of time, our consumer and revenue growth may not achieve expectations and our business, financial condition and results of operations may be adversely affected.

Our agreements with our clients have terms that range from approximately one to three years, and in some cases, our existing clients can generally terminate these agreements without cause upon 30 to 90 days’ prior written notice. In addition, many of those agreements also provide for the right of the client to terminate the agreement, or for us to pay financial penalties, in the event that we breach certain service level agreements with respect to the operation of our platform. The termination of one or more of our agreements with a client would result in a reduction in a loss of transacting accounts, transaction volume and revenue attributable to customers generated from that client relationship, and our business, financial condition, results of operations and future prospects would be materially and adversely affected.

From time to time, certain terms of our client agreements remain subject to further discussion and refinement before they can be implemented, including the potential products and services to bring to market. For example, we were unable to reach an agreement with Hidden Road Inc. regarding certain services it would provide to BakktX and without which we cannot operate the technology underlying BakktX in the manner originally intended. Our ability to realize the intended benefits of these partnerships will depend on our ability to finalize such

-37- agreements, for such products and services, and to do so on terms sufficiently favorable to us. While we continue to negotiate client agreement terms, we may be unable to agree to terms with such clients on commercially advantageous terms or at all, which may adversely affect our business and prospects.

Furthermore, our ability to retain existing, or obtain new, clients and customers may be impacted to the extent that clients choose not to partner with us, or customers choose not to transact or to engage in fewer transactions on our platform, in each case, because we do not currently offer or plan to cease offering certain crypto assets. For example, Bakkt previously delisted a substantial majority of the crypto assets that had historically been available for trading on the Bakkt Crypto platform, some of which have since been relisted. Delisting those crypto assets impacted our trading volume and revenues, and the possibility that Bakkt may again delist crypto assets may impact our trading volume and revenues and may adversely affect our client and customer relationships. If clients do not engage with us, or if customers choose not to transact or make fewer transactions on our platform, our revenues will be adversely impacted.

Any of the foregoing could, among other things, adversely impact our stock price, make us less competitive compared to our peers and otherwise significantly adversely affect our business.

Some of our current and prospective clients require the non-objection or other supervisory feedback of their own supervisors in order to deploy our solutions, and if they are unable to obtain those approvals on a timely basis, or at all, our results of operations and future prospects would be materially and adversely affected.

Some of our current and prospective clients themselves are regulated entities that may be subject to restrictions with respect to how they engage in crypto-related activities. For instance, several banks to whom we seek to provide our crypto solutions are regulated by the Federal Reserve, the Office of the Comptroller of the Currency, and/or the Federal Deposit Insurance Corporation. Pursuant to statements made by these regulators in the last few years, banks subject to their supervision are required to consult with, and potentially obtain the non-objection of, their relevant supervisor before “engaging in crypto-related activities.” If these banks, or other current or prospective clients that are supervised entities, are unable to obtain any required non-objection or other supervisory feedback of their regulators, or the timing of such non-objection or other supervisory feedback is delayed, that failure or delay would materially and adversely affect our results of operations and future prospects.

We face substantial and increasingly intense competition worldwide in the industries in which we operate.

The crypto and loyalty and rewards industries are highly competitive, rapidly changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight. We compete against a wide range of businesses in the crypto and loyalty and rewards industries generally, including those that are larger than us, have greater name recognition, larger pools of deployable capital, longer operating histories, or a dominant or more secure position, or offer other products and services to customers that we do not offer, as well as smaller or younger companies that may be more agile in responding quickly to regulatory and technological changes. Many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting consumer needs, and frequent introductions of new products and services. Competition also may intensify as businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with different aspects of our business.

We compete primarily on the basis of the following:

• ability to attract, retain and engage clients (and in turn, customers) on our platform;

• ability to demonstrate to clients that they may achieve incremental revenue and attract new customers by using and offering our services to their customers;

• confidence in the safety, security, privacy and control of customer information on our platform;

-38-

• ability to develop products and services across multiple commerce channels, including crypto and loyalty; and

• system reliability, regulatory compliance and data security.

We partner with many businesses and consider the ability to continue establishing these partnerships important to our business. Competition for relationships with these clients is intense and there can be no assurance that we will be able to continue to establish, grow, or maintain these client relationships.

Some of our current and potential competitors have larger customer bases, broader geographic scope, volume, scale, resources and market share than we do, which may provide them significant competitive advantages. Some competitors may also be subject to less burdensome licensing, anti-money laundering, counter-terrorist financing and other regulatory requirements. They may devote greater resources to the development, promotion and sale of products and services, and offer lower prices or more effectively offer their own innovative programs, products and services.

We also compete against a large number of decentralized and noncustodial platforms. On these platforms, customers can interact directly with a market-making smart contract or on-chain trading mechanism to exchange one type of crypto for another without any centralized intermediary. These platforms are typically not as easy to use as our platform, and some lack the speed and liquidity of centralized platforms, but various innovative models and incentives have been designed to bridge the gap. In addition, such platforms have low startup and entry costs as market entrants often remain unregulated and have minimal operating and regulatory costs. If the demand for decentralized platforms grows and we are unable to compete with these decentralized and noncustodial platforms, our business may be adversely affected.

If we are not able to differentiate our products and services from those of our competitors, drive value for our clients and customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively in the market.

If our platform does not meet our service level commitments, our revenue and reputation may be negatively impacted.

We typically commit, through service level agreements or otherwise, to maintaining a minimum service levels with respect to our platform’s functionality, availability and response time. If we are unable to meet these commitments, we may be obligated to provide clients with remedies set forth below. A failure to meet service level commitments, even for a relatively short duration, could cause us to be contractually obligated to issue credits or refunds to a large number of affected clients and customers, or could result in the dissatisfaction or loss of clients and customers. Affected participants could also choose to pursue other legal remedies that may be available to them.

In addition, we rely on public cloud providers, such as Microsoft Azure and Google Cloud, and any availability interruption in the public cloud could result in us not meeting our service-level commitments. In some cases, we may not have a contractual right with our public cloud providers that compensates us for any losses due to availability interruptions in the public cloud.

Any of the above circumstances or events may impact our revenues, harm our reputation, impair our ability to develop our platform and grow our base of clients and customers, subject us to financial penalties and liabilities under our service level agreements and otherwise harm our business, financial condition and results of operations.

We face operational, legal and other risks related to our reliance on third party vendors, over which we have no control.

We face operational risk because we rely on third party vendors to provide us with financial, technology and other services and to facilitate certain of our business activities, including, for example, marketing services, fulfillment services, cloud-based computer and data storage and other IT solutions and payment processing.

-39-

These third parties may be subject to financial, legal, regulatory and labor issues, cyberattacks, security incidents, privacy breaches, service terminations, disruptions or interruptions, or other problems, which may impose additional costs or requirements on us or prevent these third parties from providing services to us or our customers on our behalf, which could harm our business. Additionally, the Consumer Financial Protection Bureau (“CFPB”) and other regulators have issued guidance stating that institutions under their supervision may be held responsible for the actions of the companies with which they contract. Accordingly, we could be adversely impacted to the extent our vendors fail to comply with the legal requirements applicable to the particular products or services being offered.

In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. For example, there are a limited number of service providers that can provide the credit needed to facilitate high-volume institutional trading on ECNs, such as the BakktX ECN we plan to launch. As such, to the extent we look to add central clearing counterparty services to BakktX, we may be limited in the number of available counterparties. We may be unable to procure alternatives from other vendors in a timely and efficient manner on acceptable terms, or at all. We are also solely reliant on our agreement with our cloud computing web services provider for the provision of cloud infrastructure services to support our platform. Most of our vendor agreements are terminable by the vendor with little or no notice, and if our current vendors were to terminate their agreements with us or otherwise stop providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner and on acceptable terms, or at all. If any vendor fails to provide the services we require, fails to meet contractual requirements (including compliance with applicable laws and regulations), fails to maintain adequate data privacy controls and electronic security systems, or suffers a cyberattack or other security incident or breach, we could be subject to CFPB, Federal Trade Commission, SEC, and other regulatory enforcement actions, claims from third parties, including our customers, incur significant costs to resolve any issues or suffer economic and reputational harm, any of which could have an adverse effect on our business.

If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services may not develop, and, consequently, our business would suffer.

Rapid, significant and disruptive technological changes impact the industries in which we operate, including developments in crypto (including distributed ledger and blockchain technologies). As a result, we expect new services and technologies to continue to emerge and evolve, and we cannot predict the effects of technological changes on our business. In addition to our own initiatives and innovations, we rely in part on third parties for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products. In addition, we may not be able to accurately predict which technological developments or innovations will become widely adopted and how those technologies may be regulated. We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. Developing and incorporating new technologies into our products and services may require substantial expenditures, take considerable time, and ultimately may not be successful. In addition, our ability to adopt new products and services and to develop new technologies may be inhibited by industry-wide standards, payments networks, changes to laws and regulations, resistance to change from clients or customers, third-party intellectual property rights, or other factors. Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving industry standards. If we are unable to do so in a timely or cost-effective manner, our business could be harmed.

A large percentage of our revenue is concentrated with a single client that has notified us it will not be renewing its agreement with us. The loss of this client will materially and adversely affect our business, financial condition, results of operations and future prospects. Moreover, because of our B2B2C go-to-market model, the loss of any client—regardless of the reason— increases the risk that the customers that originally emanated from that client will transition to another provider or stop doing business with us, which would harm our business.

The concentration of a significant portion of our business and transaction volume with a limited number of clients exposes us disproportionately to the risk of any of those clients choosing to no longer partner with us, to the

-40- economic performance of such clients or their respective industries or to any events, circumstances, or risks affecting such clients or their respective industries. For example, our largest client, Webull, which represented approximately 74% and 73% of our Crypto services revenue in the years ended December 31, 2024 and 2023, respectively, has notified us that it will not be renewing its agreement with us when the current term of the agreement ends on June 14, 2025. In addition, our client Bank of America Corporation (“Bank of America”), which represented approximately 16% and 18% of our Loyalty net revenue for the years ended December 31, 2024 and 2023, respectively, notified us that it would not be renewing its commercial contract at the contract’s expiration in April 2025, subject to the Company’s obligation to provide transition services for up to a 12-month period. These events will materially and adversely affect our business, financial condition, and results of operations and future prospects to the extent we are unable to replace the revenue from such client. Our clients may terminate or reduce their use of our services, including their transaction volumes, for any number of reasons, including if they are not satisfied with our services, the value proposition of our services or platform, or our ability to meet their needs and expectations. We cannot accurately predict clients’ usage levels and the loss of clients or reductions in their usage levels of our services or transaction volumes. Any such loss or reduction could make our platform less appealing to existing and potential clients. Accordingly, the loss of any additional significant client relationship could further materially and adversely affect our business, results of operations, financial condition and future prospects.

In connection with the sale of Bakkt Trust we may become subject to retained liabilities and other risks that could adversely affect our business, financial condition and results of operations.

On March 17, 2025, we entered into an agreement for the sale of Bakkt Trust. Pursuant to the terms of the Bakkt Trust purchase agreement, we may be subject to liabilities such as legal claims, including but not limited to third-party liability and other tort claims, claims for breach of contract, employment-related claims, regulatory or other compliance with law issues, tax liabilities, or liabilities we agree to retain pursuant to the Bakkt Trust purchase agreement. If any of these liabilities are not adequately covered by insurance or an enforceable indemnity or similar agreement from a creditworthy counterparty, we may be responsible for significant out-of-pocket expenditures. Further, in connection with the Bakkt Trust purchase agreement, we may incur liabilities for breaches of representations and warranties or failure to comply with operating covenants under such agreement. Additionally, we may have to indemnify the counterparty to the Bakkt Trust purchase agreement for certain liabilities or operations of Bakkt Trust. These liabilities, if they materialize, could materially and adversely affect our business, financial position, results of operations or cash flows.

Furthermore, we may not realize the expected benefits from the Bakkt Trust sale or from a strategic transaction involving our loyalty business. For example, we expect certain operational efficiencies, cost reductions and releases of regulatory capital to follow any such disposition. If any of those or other expected benefits fail to materialize at the levels we expect or at all, our business, financial position, results of operations and available cash may be adversely affected.

We may not realize the expected benefits under the Cooperation Agreement and may be unable to successfully negotiate the terms to acquire DTR, either of which could adversely affect our business, financial condition and results of operations.

On March 19, 2025, we entered into the Cooperation Agreement, pursuant to which, among other things, DTR agreed to provide us with certain exclusive payment processing technology, application programming interfaces, and infrastructure to be integrated into our platform for the enablement of global payments processing services in the jurisdictions where we or our affiliates operate. While we expect to work with DTR under the Cooperation Agreement to integrate our platform with DTR’s technology to establish mutually beneficial stablecoin-based payment services, we may be unsuccessful in such efforts and, even if we are initially successful, we may be unable to continue such operations if we are unable to obtain the necessary regulatory approvals, which risk may be compounded by Akshay Nehata, who directly or indirectly, wholly owns DTR, serving as our Co-Chief Executive Officer and on the Board.

Additionally, under the Cooperation Agreement, we will negotiate with DTR to establish the terms of the Call Option and the Put Option. While we intend to negotiate such matters in accordance with the terms of the Cooperation Agreement, we may be unsuccessful in such efforts, which may cause us or DTR to seek to modify or

-41- terminate the other commercial agreements under the Cooperation Agreement, any of which may be adverse to our prospects, financial condition or results of operations. Further, if we establish the terms of the Put Option, DTR will have the ability to force us to acquire DTR for up to 31.5% of our common stock plus certain convertible or exchangeable securities, which may be highly dilutive to our existing stockholders.

Moreover, if we establish terms of the put/call option, and we acquire DTR or DTR exercises its right for us to acquire DTR, we may not realize the expected benefits of such acquisition. For additional information regarding the risks related to potential acquisitions, see the following risk factor.

Acquisitions, strategic investments, partnerships, or alliances may be difficult to identify. We may not realize the anticipated benefits of past or future investments, strategic transactions or acquisitions and integration of these acquisitions may pose integration challenges, divert the attention of management, disrupt our business, dilute stockholder value or otherwise adversely affect our business, financial condition and results of operations.

We have in the past and may in the future seek to acquire or invest in businesses, joint ventures, partnerships, alliances and platform technologies that we believe could complement or expand our platform, enhance our technology, or otherwise offer growth opportunities.

We may not realize the anticipated benefits of past or future investments, strategic transactions, or acquisitions, and these transactions involve numerous risks that are not within our control. These risks include the following, among others:

• difficulty in assimilating the operations, systems, and personnel of the acquired business;

• difficulty in effectively integrating the acquired technologies or products with our current products and technologies;

• difficulty in maintaining controls, procedures and policies during the transition and integration;

• disruption of our ongoing business and distraction of our management and employees from other opportunities and challenges due to integration issues;

• difficulty integrating the acquired business’s accounting, management information and other administrative systems;

• inability to retain key technical and managerial personnel of the acquired business;

• inability to retain key customers, vendors and other business clients of the acquired business;

• incurring acquisition-related costs or amortization costs for acquired intangible assets that could impact our results of operations;

• regulatory changes that affect the value of the businesses we acquire or our plans for integration of those businesses, or that expose us to additional regulation or litigation in connection with the acquired businesses;

• significant post-acquisition investments which may lower the actual benefits realized through the acquisition;

• potential failure of the due diligence process to identify significant issues with product quality, legal, and financial liabilities among other things; and

-42-

• potential inability to assert that internal controls over financial reporting are effective.

In particular, the acquisition of Bakkt Crypto presents risks to our business, including because:

• our ability to retain the legacy clients of Bakkt Crypto, and expand those relationships, is a key growth driver for us;

• we are in the process of replacing and/or augmenting many of our existing systems and relationships (e.g., agreements with crypto liquidity providers) with those historically used by Bakkt Crypto;

• we may have increased liability and/or regulatory risk from the list of additional crypto assets on our platform and from the pre-acquisition activities of Bakkt Crypto, even after we elected to delist certain of the crypto assets on the Bakkt Crypto platform; and

• the commercial relationship with Apex Clearing Corporation that is a part of the acquisition of Bakkt Crypto is a key growth driver for us, but that relationship may not produce the benefits that we envision.

Our failure to address these risks, or other problems encountered in connection with our past or future investments, strategic transactions, or acquisitions, could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities, and harm our business generally. Future acquisitions could also result in dilutive issuances of our equity securities, the incurrence of debt, contingent liabilities, amortization expenses, incremental expenses or the write-off of goodwill, any of which could harm our financial condition or results of operations, and the trading price of our Class A Common Stock could decline. For example, under the purchase agreement for the acquisition of Bakkt Crypto, we agreed to issue cash consideration of $55.0 million, up to $45.0 million in shares of our Class A Common Stock depending on Bakkt Crypto’s achievement of certain profitability targets for the fourth quarter of 2022, and up to an additional $100.0 million in shares of our Class A Common Stock depending on Bakkt Crypto’s achievement of certain financial targets through 2025. Under the purchase agreement for the acquisition of Bakkt Crypto, we have delivered approximately $9.1 million of shares of Class A Common Stock, which we expect to satisfy all of our obligations thereunder.

We may require additional capital to support the growth of our business, and such capital might not be available on acceptable terms, if at all.

We have funded our operations since inception primarily through equity financings and payments received from our platform. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business, which may require us to engage in equity or debt financings to secure additional funds. For example, in the Concurrent Offerings we issued and sold an aggregate of 1,858,062 shares of our Class A Common Stock, warrants to purchase an aggregate of 2,306,800 shares of Class A Common Stock at an exercise price of $25.50 per share, and Pre-Funded Warrants to purchase an aggregate of 448,742 shares of Class A Common Stock at an exercise price of $0.0001 per share for aggregate net proceeds of $46.5 million. Furthermore, while the ICE Credit Facility allows us to borrow up to $40,000,000, there are certain limitations on such borrowings, including graduated availability from December 31, 2024 through September 29, 2025.

Additional financing may not be available on terms favorable to us, if at all. For example, we may be required to seek the approval of ICE under the ICE Credit Facility in order to incur other indebtedness. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, financial condition, or results of operations. If we incur debt, including under the ICE Credit Facility, the debt holders would have rights senior to holders of existing securities to make claims on our assets, and the terms of any debt could restrict our operations, including our ability to pay dividends on our Class A Common Stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our existing securities. Our decision to issue securities in the future will depend on numerous considerations, including factors beyond our control, thus we cannot predict or

-43- estimate the amount, timing, or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our securities and diluting their interests.

In the past, we have identified conditions and events that raised substantial doubt about our ability to continue as a going concern and it is possible that we may identify conditions and events in the future that raise substantial doubt about our ability to continue as a going concern.

We intend to use our unrestricted cash and amounts available for borrowings under the ICE Credit Facility primarily to fund our day-to-day operations, including, but not limited to funding our regulatory capital requirements, compensating balance arrangements and other similar commitments, each of which is subject to change, and as available, to (i) activate new crypto clients, (ii) launch new crypto products in the institutional space and maintain our product development efforts, and (iii) optimize our technology infrastructure and operational support. We previously identified conditions and events that raised substantial doubt about our ability to continue as a going concern in connection with the filing of our Quarterly Report on Form 10-Q for the quarterly period ending September 30, 2023. In connection with the filing of subsequent amendments thereto, we disclosed that, without additional equity financing, we could not conclude that we could maintain our operations for a period of at least 12 months from the dates of such filings. We subsequently closed on the Concurrent Offerings and, most recently, the ICE Credit Facility, which resulted in management concluding that we had sufficient capital to continue as a going concern for at least 12 months from the date of this Form 10-K. On March 14, 2025, our largest client, Webull, notified us that it will not be renewing its agreement with us when the current term of the agreement ends on June 14, 2025. The loss of Webull will materially reduce our Crypto services revenue and raises substantial doubt about our ability to continue as a going concern for at least the next 12 months. Management has plans to reduce operating costs, including reductions in force and other spending cuts, that will preserve and extend liquidity. Management believes that these plans can be successfully implemented and alleviate the substantial doubt as of the date of this filing. However, that determination may change in the future. If we cannot continue as a viable entity, our stockholders will likely lose most or all of their investment in us.

We have experienced and may continue to experience impacts to our business as a result of our clients’ concern regarding our ability to continue as a going concern. For example, (i) one of our crypto clients closed out of all customer positions, (ii) we received inquiries from clients and prospective clients about our financial position, (iii) certain of our surety bond providers requested additional collateral, (iv) we were required to pledge as collateral the amounts that were previously required to be maintained in a concentration account for our purchasing card facility, and (v) certain of our liquidity providers requested updated payment arrangements. There can be no assurance that we will not experience additional adverse impacts to our business, including additional or accelerated account closures, loss of future potential business, and additional demands for cash or collateral, which, individually or in the aggregate may further impair our business and exacerbate the risks related to our ability to continue as a going concern.

There is significant uncertainty associated with our expansion to new markets, our launch of new products, and the growth of our revenue base given the rapidly evolving environment associated with crypto assets. Accordingly, we cannot conclude it is probable we will be able to increase revenues substantially beyond levels that we have attained in the past in order to generate sustainable operating profit and sufficient cash flows to continue doing business without raising additional capital in the near future.

If we are required to raise additional funding in the future to maintain our operations or we are unable to access any or all of the amounts available under the ICE Credit Facility, we cannot be certain that additional capital, whether through selling additional equity or debt securities or obtaining additional lines of credit or other loans, will be available to us or, if available, will be on terms acceptable to us. If we issue additional securities to raise funds, these securities may have rights, preferences, or privileges senior to those of our common stock, and our current stockholders may experience dilution. If we are unable to obtain funds when needed or on acceptable terms, we may be required to curtail our current platform expansion programs, cut operating costs, forego future development and other opportunities or even terminate our operations. In addition, even though as of the filing of this Form 10-K, we determined that the Company has sufficient capital to continue as a going concern for at least 12 months, we may be

-44- unable to recover with investors, clients and customers due to the adverse reputational effects we experienced previously or may experience in the future.

We hold our cash and cash equivalents that we use to meet our working capital and operating expense needs in deposit accounts that could be adversely affected if the financial institutions holding such funds fail.

We hold our cash and cash equivalents that we use to meet our working capital and operating expense needs in deposit accounts at multiple financial institutions. The balances held in these accounts typically exceed the Federal Deposit Insurance Corporation deposit insurance limit. If a financial institution in which we hold such funds fails or is subject to significant adverse conditions in the financial or credit markets, we could be subject to a risk of loss of all or a portion of such uninsured funds or be subject to a delay in accessing all or a portion of such uninsured funds. Any such loss or lack of, or delay in, access to these funds could adversely impact our liquidity and our ability to meet our ongoing working capital and operating expense obligations.

We also maintain investment accounts with other financial institutions in which we hold our investments and, if access to these investments were to be impaired, we may not be able to open new operating accounts, sell investments or transfer funds from our investment accounts to new operating accounts on a timely basis sufficient to meet our operating expense obligations. In addition, if further liquidity and financial stability concerns arise with respect to banks and financial institutions, the ability of our clients or their customers to access existing cash, cash equivalents or investments or to access existing, or enter into new, banking arrangements or facilities, may be adversely impacted, which could in turn impact such parties’ ability to pay their obligations to us or to our clients, or to enter into new commercial arrangements with us.

The loss of the services of our senior management could adversely affect our business.

The experience of our senior management is a valuable asset to us. If we are unable to retain members of our core senior management team, we could experience uncertainty and significant delays or difficulty in the achievement of our development and strategic objectives and our business, financial condition and results of operations could be materially and adversely harmed. Our management team has significant experience, is responsible for many of our core competencies, and would be difficult to replace. Competition for senior executives in these businesses is intense, and we may not be able to attract and retain qualified personnel to replace or succeed members of our senior management team or other key personnel. Failure to retain talented senior leadership could have a material adverse effect on our business.

Changes in our executive management team resulting from the hiring or departure of executives, or our leadership structure, could disrupt our business, and could impact our ability to preserve our culture, which could negatively affect our ability to recruit and retain personnel. For example, effective March 21, 2025, Akshay Naheta will be appointed as our Co-Chief Executive Officer, to serve in such role along with Andrew Main. This is a somewhat atypical leadership structure, and such structure may not achieve the benefits we intend. Furthermore, Mr. Naheta agreed to serve as our Co-Chief Executive Officer in connection with our entrance into the Cooperation Agreement with him and DTR, which is an entity that is directly or indirectly wholly owned by Mr. Naheta. To the extent our negotiations to acquire DTR are unsuccessful, Mr. Naheta may determine to no longer serve as our Co-Chief Executive Officer or seek to modify his role with us.

Any departure of an executive could be particularly disruptive in light of the leadership transition.

Our business will suffer if we fail to attract and retain highly skilled employees.

Our future success will depend on our ability to identify, hire, develop, motivate and retain highly qualified personnel for all areas of our organization, particularly information technology and sales. Hiring qualified and experienced personnel in this specialized technology space is difficult due to the high level of competition and scarcity of experience. Further, on May 2, 2024, we announced a reduction in force resulting in the termination of 28 employees, which may limit our ability to attract and retained qualified and experienced personnel. Many of the companies with which we compete for experienced employees have greater resources than we do and may be able to

-45- offer more attractive terms of employment. In addition, we invest significant time and expense in training employees, which increases their value to competitors that may seek to recruit them. We may not be able to attract, develop and maintain the skilled workforce necessary to operate our business and labor expenses may increase as a result of a shortage in the supply of qualified personnel, which would negatively impact our business. Further, we may suffer shortages with respect to certain categories of personnel due to reductions in force, attrition, inability to hire qualified and experienced personnel, or any combination of the foregoing, which may negatively impact our operational performance. For example, if we suffer shortages with respect to certain of our customer service personnel, our ability to maintain compliance with our service level commitments to clients may be impacted, resulting in financial penalties and, potentially, damage to or loss of those client relationships. Shortages with respect to certain of our compliance personnel may limit our ability to comply with evolving and uncertain laws and other regulations. For additional information, see “—Risks Related to Regulation, Taxation and Laws.” Shortages with respect to certain of our accounting personnel may limit our ability to maintain internal control over financial reporting. For more information, see “—Risks Related to Risk Management and Financial Reporting.”

Our revenue is impacted, to a significant extent, by the general economy.

Our business and our clients’ businesses are sensitive to macroeconomic conditions. Economic factors such as interest rates, tariffs, inflation, changes in monetary and related policies, market volatility (including as a result of geopolitical issues, such as the wars in Ukraine and the Middle East), consumer confidence, and unemployment rates are among the most significant factors that impact consumer spending behavior. Weak economic conditions, high interest rates, inflation or a significant deterioration in economic conditions reduce the amount of disposable income consumers have, which in turn reduces consumer spending and the willingness of consumers to accumulate and spend crypto and loyalty points or otherwise transact in such assets, which would have an adverse effect on our business, results of operations, financial condition, and future prospects. In particular, the high levels of inflation experienced in the United States could negatively impact our business by increasing our costs and reducing consumer activities necessarily to our revenue generation.

Our ability to generate subscription and service revenue and transaction revenue depends, in part, on customers continuing to access and utilize our platform. Our clients’ businesses may decrease or fail to increase as a result of factors outside of their control, such as the macroeconomic conditions referenced above, or business conditions affecting a particular client, industry vertical, or region. Weak economic conditions also could extend the length of our clients’ sales cycle and cause consumers to delay making (or not make) purchases. Some of our clients have experienced a decrease in sales, supply chain disruptions, inventory shortages, and other adverse effects. A decline in activity by consumers of our clients’ products and services for any reason may correspondingly result in lower revenue generated by our platform.

If we experience rapid growth, it may place significant demands on our operational, administrative and financial resources and it may be difficult to sustain such growth.

We have a relatively limited operating history even at our current scale, and our projected growth in future periods exposes us to increased risks, uncertainties, expenses and difficulties. If we are unable to appropriately scale our operations to support such growth, our business, results of operations, financial condition and future prospects would be materially and adversely affected.

If we experience rapid growth, we could face significant challenges in:

• maintaining and developing relationships with existing and new clients;

• securing funding to maintain our operations and future growth;

• maintaining adequate financial, business and risk controls;

• implementing new or updated information and financial risk controls and procedures;

-46-

• navigating complex and evolving regulatory and competitive environments;

• attracting, integrating and retaining an appropriate number of qualified, skilled employees;

• training, managing and appropriately sizing our workforce and other components of our business on a timely and cost-effective basis;

• expanding within existing markets;

• entering new markets and introducing new solutions;

• continuing to develop, maintain, protect and scale our platform;

• effectively using limited personnel and technology resources; and

• maintaining the security of our platform and the confidentiality of the information, including personally identifiable information, provided and utilized across our platform.

We may not be able to properly manage and scale our expanding operations effectively, and any failure to do so could adversely affect our ability to generate revenue and control our expenses, which could in turn materially and adversely affect our business, financial condition, results of operations and future prospects.

Future material impairments in the value of our long-lived assets, including goodwill, have in the past negatively affected, and could in the future negatively affect, our operating results.

We regularly review our long-lived assets, including our goodwill and other intangible assets, for impairment. Goodwill and other intangible assets are subject to impairment review on an annual basis and whenever potential impairment indicators are present. Changes in market conditions or other changes in the future outlook of value may lead to impairment charges in the future. Future events or decisions may lead to asset impairments and/or related charges. Certain non-cash impairments may result from a change in our strategic goals, business direction or other factors relating to the overall business environment. Material impairment charges could negatively affect our results of operations.

For example, during the fiscal year ended December 31, 2023, we recognized $60.5 million of goodwill and intangible assets impairments relating to the sustained decline in our market capitalization and failure to achieve our projected revenue growth. Further adverse changes to the timing for expected crypto product activations and declines in market capitalization could lead to additional goodwill or intangible asset impairment charges in future periods, which could be material to our results of operations. Additionally, Webull’s decision not to renew its agreement with us when the current term of the agreement ends on June 14, 2025 increases the risk of a goodwill impairment. For more information on the valuation and impairment of long-lived assets, refer to Note 5 in our audited consolidated financial statements included in this Form 10-K.

We may not be successful in achieving expected operating efficiencies and sustaining or improving operating expense reductions, and might experience business disruptions and adverse tax consequences associated with restructuring, realignment and cost reduction activities.

Portions of our business have been, and may in the future be, the subject of restructuring, realignment or cost reduction initiatives. For example, in the fourth quarter of 2022 and first quarter of 2023, we commenced a restructuring plan in order to simplify and focus on our core capabilities. The streamlining effects of the plan could result in reduced revenue or increased costs due to additional reliance on third-party service providers, which may adversely impact our business operations. In addition, we may not be successful in achieving the full efficiencies and cost reduction benefits we expect or such benefits might be realized later than expected, and the ongoing costs of implementing these measures might be greater than anticipated. In addition, we might undertake additional restructuring efforts, which could result in future charges. Moreover, our ability to achieve our other strategic goals

-47- and business plans might be adversely affected, and we could experience business disruptions, if our restructuring and realignment efforts and our cost reduction activities prove ineffective.

There is focus from certain investors, regulators, employees, users and other stakeholders concerning corporate responsibility, specifically related to environmental, social, and governance matters (“ESG”) and related assurances and disclosures. Compliance with recently adopted and potential upcoming ESG requirements, including California’s climate-related bills, may require the dedication of significant time and resources by us. If we are unable to comply with new laws and regulations or changes to existing legal or regulatory requirements concerning ESG matters, or if we fail to meet investor, industry, or stakeholder expectations and standards relating to ESG matters, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business, operating results, and financial condition could be adversely affected.

Risks Related to Crypto

Regulations governing crypto and blockchain may change rapidly, which may force us to change our business quickly to adapt and may change the competitive landscape.

The changes in presidential administration and control of the U.S. Congress (“Congress”) in 2025 may result in a new regulatory approach to crypto and blockchain, including newly adopted laws and regulations, changes in approach to enforcement, and new interpretations of existing laws. President Donald J. Trump has issued an executive order designed to increase federal government support of the crypto industry, including by establishing a President’s Working Group on Digital Asset Markets that is directed to identify existing regulations that should be rescinded or modified and to develop a new regulatory framework for crypto, among other things. Similarly, the SEC has established a new Crypto Task Force that will develop a framework for SEC policies governing crypto and has moved to end or pause several enforcement actions and investigations involving companies in the crypto industry. For example, lawmakers and regulators may adopt policies permitting broader or more restricted transactions in certain digital assets, allowing or providing new regulatory clarity to additional types of activities in the crypto markets, and/or imposing or allowing new forms of registration or licensing on entities involved in those activities. Similarly, federal and state regulators may change or decrease their emphasis on enforcement in the crypto industry. While this could bring more certainty and potentially provide support to the crypto markets and our existing and potential customers, it is unclear what, if any, changes may be adopted and what the effects of those changes may be on our business and current operations. We may, based on any regulatory changes, be forced to adapt our business model to comply with new laws, perhaps quickly. Any such changes could negatively impact our operations and the services we provide customers, including on our crypto trading platform. In addition, if we are not able to adapt our business lines and practices quickly enough, it may cause us to lose customers and negatively affect our profitability. Any required changes could also be costly to implement.

In addition, more regulatory certainty or less enforcement could encourage more entrants into the market, which could increase the competition for our customers and impact our potential profitability. Our competitors may alternatively anticipate a more permissive regulatory environment and, as a result, offer new products or services that we deem to exceed the scope of what is permitted under current regulation. These competitors could attract and retain clients and transaction volume from us, which may in turn negatively affect our business, but those competitors may ultimately escape regulatory scrutiny. This could put us at a competitive disadvantage.

Volatility and disruptions in the crypto market may subject us to additional risks.

Many crypto assets are volatile, and financial distress in the crypto market from time to time (such as bankruptcies filed by certain providers of banking services to crypto companies) has increased uncertainty in the macroeconomic environment. There is no certainty that the measures we have taken or whether an improving regulatory environment will be sufficient to address the risks posed by any crypto market disruption and volatility,

-48- including those caused by any recession or economic downturn that may occur, and we may experience material and adverse impacts to our business as a result.

The ultimate impact of any volatility or distress in the crypto market will depend on future developments, including, but not limited to, the downstream effects of bankruptcies filed by crypto market participants, their severity, and the actions taken by regulators to address its impact. Any deterioration in the crypto markets may have an adverse effect on our reputation, and any negative perception by our clients of crypto may lead to a loss of client demand for our products and services, any of which could have an adverse impact on our business and financial condition. We may also suffer a decline in the market price of our Class A Common Stock due to any negative perception by our clients, investors, or the general public, of crypto or the crypto market.

Due to unfamiliarity and some negative publicity associated with crypto platforms, existing and potential customers may lose confidence in crypto platforms, which could have an adverse impact on our business.

Numerous crypto platforms have been sued, investigated, or shut down due to fraud, manipulative practices, business failure and security breaches. In many of these instances, customers of these platforms were not compensated or made whole for their losses. For example, in May 2019, Binance, one of the world’s largest platforms, was hacked, resulting in losses of approximately $40 million, and in February 2021, Bitfinex settled a long-running legal dispute with the State of New York related to Bitfinex’s alleged misuse of over $800 million of customer assets. Further, in 2022, each of Celsius Networks, Voyager, Three Arrows Capital and FTX declared bankruptcy, resulting in a loss of confidence in participants of the crypto economy and negative publicity surrounding crypto more broadly. In August 2023, crypto asset exchange Bittrex Inc. and its co-founder and former CEO agreed to settle charges that they operated an unregistered national securities exchange, broker, and clearing agency, and agreed to make a total monetary payment of $24 million. In November 2023, three federal U.S. agencies-the U.S. Department of the Treasury, through FinCEN and OFAC, the U.S. Department of Justice (“DOJ”), and the Commodity Futures Trading Commission (“CFTC”) all announced enforcement actions against Binance. The actions announced required Binance to pay, in the aggregate, over $4.3 billion in criminal forfeiture, penalties, and fines, and also required Changpeng Zhao, the founder of Binance, to plead guilty to criminal money laundering charges.

In response to these events, the crypto markets experienced extreme price volatility, certain markets experienced issues with liquidity, and several other entities in the crypto industry were negatively affected, undermining confidence in the crypto markets and in bitcoin and in other digital assets. If the liquidity of the crypto markets continues to be negatively impacted by events like these, crypto prices may continue to experience significant volatility and confidence in the crypto markets may be further undermined.

In addition, there have been reports that a significant amount of crypto trading volume on crypto platforms is fabricated and false in nature, with a specific focus on unregulated platforms located outside the United States. Such reports may indicate that the market for crypto platform activities is significantly smaller than otherwise understood. Negative perception, a lack of stability and standardized regulation in the crypto industry, and the closure or temporary shutdown of crypto platforms due to fraud, business failure, hackers or malware, or government mandated regulation, and associated losses suffered by customers may reduce confidence in the crypto economy and demand for crypto products and services, and result in greater volatility of the prices of crypto, including significant depreciation in value. Any of these events could reduce customer demand for our products and services and have an adverse impact on our business.

There may be a perception among regulators and others that crypto is used to facilitate illegal activity such as fraud, money laundering, tax evasion and scams. Because we provide the ability to transact in crypto, any negative perceptions associated with crypto could harm our reputation.

Crypto may be perceived by some regulators and the general public as being susceptible to, and in fact has been used on numerous occasions for, illegal or improper uses, including money laundering, tax evasion, terrorist financing, illegal online gambling, fraudulent sales of goods or services, illegal sales of prescription medications or controlled substances, piracy of software, movies, music and other copyrighted or trademarked goods (in particular,

-49- crypto goods), bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or ponzi schemes, or to facilitate other illegal activity. Because our platform allows customers to transact in crypto, this perception may harm our reputation because we could be viewed as facilitating, or could otherwise become associated with, these illegal activities. Any such negative perception of our reputation could harm our business.

In addition, because we use a B2B2C go-to-market strategy, our ability to attract customers (and in turn, transaction volume that generates revenue) depends on our ability to attract and enter into relationships with clients. To the extent that these clients perceive crypto as a risky sector, or one that these clients do not wish to associate with (or allow their customers to associate with through that client’s brand), that would have a material adverse effect on our business.

Further, banks may not provide banking services, or may cut off banking services, to businesses that provide crypto-related services, which could dampen liquidity in the market and damage the public perception of crypto generally or any one crypto asset in particular, which could decrease the trading volume of crypto.

Crypto custodial solutions and related technology, including our systems and custodial arrangements, are subject to risks related to a loss of funds due to theft of crypto, employee or vendor sabotage, security and cybersecurity risks, system failures and other operational issues, the loss, destruction or other compromise of our private keys and a lack of sufficient insurance.

Bakkt Crypto utilizes certain third-party custodians and self-custodies select crypto assets to facilitate customer withdrawals utilizing the Fireblocks Vault service. Such solutions involve the processing, storage and transmission of crypto and data. Contractual limits on our exposure in the event that crypto is stolen or misappropriated may not be sufficient to protect us from liability or other harm. The theft or misappropriation of crypto held in custody by us would likely result in financial loss, reputational damage, potential lack of trust from our customers, negative press coverage, and diversion of our management’s time and focus. The secure storage and transmission of crypto and data over networks is a critical element of our operations. Threats to our operations come from external factors such as governments, organized crime, hackers, and other third parties such as outsourced or infrastructure-support providers and application developers, or may originate internally from an employee or service provider to whom we have granted access to our systems.

Crypto transactions are generally irrevocable, and stolen or incorrectly transferred crypto may be irretrievable. Once a transaction has been verified and recorded in a block that is added to the distributed ledger, an incorrect transfer of crypto generally will not be reversible, and we may not be able to obtain compensation for any such transfer or theft. It is possible that, through computer or human error, or through theft or criminal action, the crypto could be transferred in incorrect amounts or to unauthorized third parties, or to uncontrolled accounts. Such events would have a material adverse effect on our ability to continue as a going concern.

Crypto is controllable only by the possessor of private keys relating to the distributed ledger through which the crypto is held. While the distributed ledgers require a public key relating to a crypto asset to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the crypto asset. To the extent our private keys are lost, destroyed, or otherwise compromised and no backups of the private keys are accessible, we will be unable to access the crypto held through the distributed ledger. Any loss of private keys relating to, or hack or other compromise of, our crypto could adversely affect our consumers’ ability to access or sell their crypto and could harm consumers’ trust in us and our products. Additionally, any loss of private keys relating to, or hack or other compromise of, the distributed ledger through which third parties store crypto could have negative reputational effects on us and harm consumers’ trust in us and our products.

Our insurance policies may not be adequate to reimburse us for losses caused by security breaches or incidents, and we may lose crypto valued in excess of the insurance policy without any recourse. Unlike bank accounts or accounts at some other financial institutions, in the event of loss or loss of utility value, there is no

-50- public insurer to offer recourse to us or to any consumer and the misappropriated crypto may not be easily traced to the bad actor.

Further, when crypto custodial solutions or transfer venues, whether involving our systems or others, experience system failures or other operational issues, such events could result in a reduction in crypto prices or confidence and impact our success and have a material adverse effect on our ability to continue as a going concern.

Our failure to safeguard and manage our customers’ crypto could adversely impact our business, operating results, and financial condition.

Bakkt Crypto buys, sells, sends and receives crypto to fulfill buy and sell orders from individual and institutional customers and, in some cases, works with third-party vendors which provide custodial services to such customers and, in other cases, self-custodies select crypto assets through the use of the Fireblocks Vault service. Should we or one of our third-party custodians fail to implement or maintain the policies, procedures and controls necessary to secure the custody of the crypto assets entrusted to us by our customers in full compliance with applicable law and regulation, the Company could suffer reputational harm and/or significant financial losses; face litigation or regulatory enforcement action potentially leading to significant fines, penalties, and additional restrictions; and see its customers discontinue or reduce their use of our and our clients’ products. Any of these occurrences could adversely impact our business, operating results, and financial condition.

We regard the crypto assets that we self-custody using the Fireblocks Vault service for customers as the property of those customers, who benefit from the rewards and bear the risks associated with their ownership, and we believe that customer crypto assets, consistent with the nature and terms of the services we offer and applicable law, would not be made available to satisfy the claims of our general creditors in the event of our bankruptcy. In addition, since the acquisition of Bakkt Crypto, we have utilized the services of third-party custodians to hold crypto assets in custody for the benefit of Bakkt Crypto customers. These third-party custodians maintain their own bankruptcy protection procedures and contractual protections designed with the goal that the crypto assets held in custody by these third-party custodians would not be made available to satisfy the claims of such custodian’s general creditors in the event of bankruptcy. However, insolvency law is not fully developed with respect to the holding of crypto assets in custodial arrangements and continues to develop. As a result, there is a risk that crypto assets held in custody could be considered to be the property of a bankruptcy estate in the event of a bankruptcy, and that the crypto assets held in custody on behalf of our customers could be subject to bankruptcy proceedings and such customers could be treated as general unsecured creditors. This prospect may result in customers finding our custodial services more risky and less attractive.

Bakkt Crypto uses omnibus wallets to hold crypto assets belonging to the Company as well as crypto assets held for the benefit of and on behalf of customers. The balances of Bakkt Crypto-owned assets in such wallets are de minimis and are maintained solely to facilitate customer transactions, such as by funding the payment of transfer fees and addressing rounding conventions and trade errors. Although the Company maintains detailed internal ledgers recording the ownership of crypto assets held in Company-controlled omnibus wallets, the use of omnibus wallets could complicate the disposition or treatment of customer crypto assets in the event of our bankruptcy, including by increasing the risk that crypto assets held in the omnibus wallets are considered to be the property of our bankruptcy estate.

Further, on March 31, 2022, the SEC issued Staff Accounting Bulletin (“SAB”) No. 121, which represented a significant change regarding how a company safeguarding crypto held for its platform users reports such crypto on its balance sheet. On January 23, 2025, the SEC issued SAB No. 122, which rescinded SAB No. 121. Any future changes in U.S. generally accepted accounting principles (“GAAP”) that require us to change the manner in which we account for our crypto held for our customers could have a material adverse effect on our financial results, our regulatory capital requirements, and the market price of our securities.

See “—Risks Related to Risk Management and Financial Reporting—Future changes in financial accounting standards may significantly change our reported results of operations.”

-51-

Crypto does not have extensive historical precedent, and distributed ledger technology continues to rapidly evolve. The unique characteristics of crypto presents risks and challenges to us that could have a material adverse effect on our business.

Crypto does not have extensive historical precedent, and distributed ledger technology continues to rapidly evolve. Given the infancy of the development of crypto networks, parties may be unwilling to transact in crypto, which would dampen the growth, if any, of crypto networks. Bakkt Crypto buys, sells, sends and receives crypto to fulfill buy and sell orders from individual and institutional customers and, in some cases, works with third-party vendors which provide custodial services to such customers and, in other cases, self-custodies select crypto assets through the use of the Fireblocks Vault service. The rate of change of crypto networks can present technological challenges and require us to expend significant time and expenditures to adapt to new crypto network technologies. Acceptance of software patches or upgrades by a significant, but not overwhelming, percentage of the users and miners in a crypto network, such as the Bitcoin Network, could result in a “fork” in such network’s distributed ledger, resulting in the operation of multiple separate networks. This could require us to develop and incorporate new technologies to integrate with the new fork, which may require substantial expenditures and take considerable time, if it can be done at all. Until such time as we develop and incorporate such new technologies, consumers may not be able to access new forks or the assets available on new forks. Because crypto networks are dependent upon the internet, a disruption of the internet or a crypto network, such as the Bitcoin Network, would affect the ability to transfer crypto. The realization of one or more of the foregoing risks may have a material adverse effect on our business. Moreover, because crypto has been in existence for a short period of time and is continuing to develop and evolve, there may be additional risks in the future that are impossible to predict and which could have a material adverse effect on our business.

We may encounter technical issues in connection with the integration of supported crypto assets and changes and upgrades to their underlying networks, which could adversely affect our business.

In order to support any particular crypto asset, a variety of front and back-end technical and development work is required to integrate such supported crypto asset with our existing technical infrastructure. For certain crypto assets, a significant amount of development work is required, and there is no guarantee that we will be able to integrate successfully with any existing or future crypto asset. In addition, integration may introduce software errors or weaknesses into our platform, including our existing infrastructure. Even if integration is initially successful, any number of technical changes, software upgrades, soft or hard forks, cybersecurity incidents, bugs, errors, defects or other changes to the underlying blockchain network may occur from time to time, causing incompatibility, technical issues, disruptions, or security weaknesses to our platform. If we are unable to identify, troubleshoot and resolve any such issues successfully, we may no longer be able to support such crypto assets, our customers’ assets may be frozen or lost, the security hot, warm, or cold wallets established at our direction by third-party vendors may be compromised, and our platform and technical infrastructure may be affected, all of which could adversely impact our business.

The blockchains on which ownership of crypto is recorded are dependent on the efforts of third parties acting in their capacity as the blockchain transaction miners or validators, and if these third parties fail to successfully perform these functions, the operation of the blockchains that record ownership of crypto could be compromised.

Blockchain miners or validators maintain the record of ownership of crypto. If these entities suffer from cyberattacks or other security incidents (whether from hacking, which involves efforts to gain unauthorized access to information or systems, or to cause intentional malfunctions or loss or corruption of data, software, hardware or other computer equipment, the inadvertent transmission of computer viruses, ransomware or other malware, other forms of malicious attacks, malfeasance or negligent acts of its personnel, or via other means, including phishing attacks and other forms of social engineering), of for financial or other reasons cease to perform these functions, the functioning of the blockchains on which the ownership of a crypto asset is recorded and the valuation based may be jeopardized. Any such interruption could result in loss of crypto and/or its value.

-52-

In addition, over the past several years, crypto mining operations have evolved from individual users mining with computer processors, graphics processing units and first-generation application specific integrated circuit (“ASIC”) machines to “professionalized” mining operations using proprietary hardware or sophisticated machines. If the profit margins of crypto mining operations are not sufficiently high, crypto miners are more likely to immediately sell tokens earned by mining, resulting in an increase in liquid supply of that crypto, which would generally tend to reduce that crypto’s market price.

Excessive redemptions or withdrawals, or a suspension of redemptions or withdrawals, of crypto assets could adversely impact our business.

We have procedures to process redemptions and withdrawals promptly in accordance with the terms of the applicable user agreements. We could experience process-related withdrawal or redemption delays if there were to be a significant and unexpected volume of withdrawal or redemption requests, including in the case of economic disruptions that trigger significant concerns about the stability of the markets. For example, following our disclosure regarding our ability to continue as a going concern in February 2024, one of our clients closed out of its customer positions. To the extent we have process-related delays, even if the delays are brief or due to blockchain network congestion or heightened redemption activity, and even if the delays are within the terms of an applicable user agreement or otherwise communicated by us, we may nonetheless experience, among other things, increased customer complaints, damage to our brand and reputation and additional regulatory scrutiny, any of which could adversely affect our business.

Risks Related to Regulation, Taxation and Laws

Our business is subject to extensive government regulation, oversight, licensure and approvals. Our failure to comply with extensive, complex, uncertain, overlapping and frequently changing rules, regulations and legal interpretations could materially harm our business.

Our business is subject to laws, rules, regulations, policies and legal interpretations in the markets in which we operate, including, but not limited to, those governing money transmission, crypto asset business activity, consumer protection, anti-money laundering, counter-terrorist financing, privacy and data protection, cybersecurity, economic and trade sanctions, commodities, derivatives, and securities. These laws and regulations are subject to uncertainty and change, and any policy or regulatory changes could affect our business significantly, particularly if we are unable to adapt quickly. See “—Risks Related to Crypto—Regulations governing crypto and blockchain may change rapidly, which may force us to change our business quickly to adapt and may change the competitive landscape.”

We have been, and expect to continue to be, required to apply for and maintain various licenses, certifications and regulatory approvals in jurisdictions where we provide our services, including due to changes in applicable laws and regulations or the interpretation of such laws and regulations. There can be no assurance that we will elect to pursue, or be able to obtain, any such licenses, certifications and approvals. In addition, there are substantial costs and potential product changes involved in maintaining and renewing such licenses, certifications and approvals. For instance, in the United States, Bakkt Crypto has obtained licenses to operate as a money transmitter (or its equivalent) in the states where it operates and where such licenses are required, as well as in the District of Columbia and Puerto Rico, and as a virtual currency business with the State of New York. In these capacities, Bakkt Crypto is subject to reporting requirements, restrictions with respect to the investment of consumer funds, bonding requirements and inspection by state regulatory agencies. We expect federal regulation to change further in connection with the new U.S. Presidential Administration and Congress in 2025. This could result in new registration or licensing requirements subjecting us to additional oversight.

As we expand our international business activities, both as to the products and services offered and into jurisdictions within and beyond the United States, we have become increasingly obligated to comply with new laws and regulations, including those of any additional countries and markets in which we operate, and we may be subject to increased regulatory oversight and enforcement and more restrictive rules and regulations. Laws outside of the United States often impose different, more specific, or even conflicting obligations on companies, as well as broader

-53- liability. For example, certain transactions that may be permissible in a local jurisdiction may be prohibited by regulations of U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) or U.S. anti-money laundering or counter-terrorist financing regulations. Our ability to manage our business and conduct our operations internationally will require considerable management attention and resources, particularly as we have no operating history outside the United States and limited experience with international regulatory environments and market practices. Our failure to successfully manage regulatory risks could harm our international operations and have an adverse effect on our business, operating results, and financial condition.

As we expand our activities, we become increasingly obligated to comply with the laws, rules, regulations, policies and legal interpretations of both the jurisdictions in which we operate and those into which we offer services on a cross-border basis. For instance, financial regulators outside the United States have increased scrutiny of crypto asset platforms over time, such as by requiring crypto asset platforms operating in their local jurisdictions to be regulated and licensed under local laws. To the extent a customer accesses our services outside of jurisdictions where we have obtained required governmental licenses and authorization, we face a risk of becoming subject to regulations in that local jurisdiction. A regulator’s conclusion that we are servicing customers in its jurisdiction without being appropriately licensed, registered or authorized could result in fines or other enforcement actions.

Additionally, through our relationships with clients that are banks, we are subject to risk management standard for third-party relationships in accordance with federal bank regulatory guidance and to examinations by the federal banking regulators should these regulators exercise their authorities under applicable law. Should we, these banks, or prospective clients that are banks be unable to satisfy these standards, that failure would materially and adversely affect our business, operating results, and financial condition.

In general, any failure or perceived failure to comply with existing or new laws, regulations, or orders of any regulatory authority (including changes to or expansion of the interpretation of those laws, regulations, or orders) may subject us to liability, significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets and enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, increase regulatory scrutiny of our business, restrict our operations and force us to change our business practices, make product or operational changes, including ceasing our operations in certain jurisdictions, or delaying planned product launches or improvements. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brand and business, impose substantial costs and adversely affect our financial condition and results of operations. The complexity of U.S. federal and state regulatory and enforcement regimes, coupled with the scope of our operations and the evolving regulatory environment, could result in a single event giving rise to a large number of overlapping investigations and legal and regulatory proceedings by multiple authorities. Moreover, we cannot provide any assurance that our employees, contractors, or agents will not violate such laws and regulations.

Regulatory regimes governing blockchain technologies and crypto are evolving and uncertain, and new legislation, regulations, guidance and enforcement actions have in the past required, and may in the future require, us to alter our business practices.

Significant parts of our business, such as our product and service offerings involving crypto, are subject to uncertain and/or evolving regulatory regimes. As crypto has grown in both popularity and market size, governments have reacted differently, with certain governments deeming it illegal and others allowing its use and trade without restriction. The failures of risk management and other control functions at other companies that played a role in the 2022 and 2023 events have accelerated, and continue to accelerate, an existing regulatory trend toward stricter oversight of crypto platforms and the crypto industry. Legislation, regulations and enforcement actions applicable to crypto in the United States include, but are not limited to the following:

• In 2023, the SEC initiated lawsuits against certain crypto asset exchanges, including Bittrex, Coinbase, Binance, and Kraken alleging among other things that those entities operated as unregistered national securities exchanges, unregistered broker-dealers and unregistered clearing agencies and alleging that certain crypto assets available on their platforms are securities. In February and March 2025, the SEC

-54- reportedly dropped several enforcement cases involving these types of actions, including that against Coinbase.

• The CFTC staff has publicly taken the position that certain crypto assets are commodities, and as such, exchange-traded derivatives involving bitcoin are subject to the CFTC’s jurisdiction and enforcement powers. This has been reflected in certain CFTC enforcement actions, including those against Coinflip, Inc. and certain informal CFTC guidance, such as the LabCFTC’s Primer on Virtual Currencies.

• In June 2023, the CFTC won a default judgment against Ooki DAO, a decentralized autonomous organization that the CFTC charged with operating an illegal trading platform and unlawfully offering leveraged and margined retail commodity transactions in crypto assets outside of a registered exchange, unlawfully acting as a Futures Commission Merchant (FCM), and unlawfully failing to comply with BSA obligations applicable to FCMs.

• In July 2023, a court in the Southern District of New York held that Ripple Labs, Inc.’s (“Ripple”) sales of XRP to sophisticated investors pursuant to written contracts did constitute the unregistered offer and sale of investment contracts while sales of XRP to purchasers through blind bid/ask transactions on crypto asset exchanges did not constitute the sale of unregistered securities. In 2024, Ripple was assessed a $125 million civil penalty. These rulings are under appeal and the future of the litigation is uncertain.

• On July 31, 2023, a different court in the Southern District of New York held that the SEC had asserted a plausible claim that certain inter-related crypto assets offered by Terraform Labs qualified as investment contracts.

• In September 2023, the CFTC issued orders and simultaneously filed and settled charges against Opyn, Inc., ZeroEx, Inc., and Deridex, Inc., alleging that each had offered users the ability to trade crypto asset derivatives without registering with the CFTC as one or more regulated entities.

• Congress has expressed the need for both greater federal oversight of the crypto industry and comprehensive crypto asset legislation. Congress considered bills that would create new federal frameworks for crypto, including the Financial Innovation and Technology for the 21 st Century Act (“FIT 21”), which in 2024 was passed by the House of Representatives but stalled in the Senate and has been reintroduced in 2025, and legislation that would provide a regulatory framework for stablecoins.

• Certain state regulators, such as NYDFS, have created or are in the process of creating new regulatory frameworks with respect to crypto. For example, in 2015, the State of New York adopted the “BitLicense,” the first U.S. regulatory framework for licensing participants in crypto business activity. Bakkt Crypto currently operates under a BitLicense. On January 25, 2023, NYDFS released guidance regarding crypto custody practices, providing that a “virtual currency entity custodian” must: (1) separately account for and segregate customer assets from proprietary assets, (2) take possession of customer assets only for the limited purpose of carrying out custody and safekeeping services, (3) request approval before implementing any sub-custody arrangements, and (4) provide adequate disclosure to customers. In addition, Louisiana adopted a virtual currency regulation, effective as of January 1, 2023, which requires operators of virtual currency businesses to obtain a virtual currency license in order to conduct business in Louisiana. We operate in Louisiana under such license. Other states, such as Texas, have published guidance on how their existing regulatory regimes governing money transmitters apply to virtual currencies. Some states, such as New Hampshire, North Carolina and Washington, have amended their state’s statutes to clarify the treatment of virtual currencies within existing licensing regimes, while others have interpreted their existing statutes as requiring a money transmitter license to conduct certain virtual currency business activities.

• FinCEN has released guidance regarding how it considers its regulations to apply to crypto businesses.

-55-

• The IRS released guidance treating crypto as property that is not currency for U.S. federal income tax purposes.

• In October 2023, the governor of California signed into law the DFAL, which establishes a required licensing framework administered by the DFPI for entities engaged in digital financial asset business activity in the state of California. The Company expects that its business will require licensure under the DFAL and will therefore take steps to obtain necessary licenses prior to the enactment’s effective date of July 1, 2026. The Company notes that the DFAL provides that the DFPI may issue a conditional license to companies, such as our subsidiaries, that maintain licenses to conduct virtual currency business activity in New York or hold a charter as a New York limited purpose trust company with approval to conduct a virtual currency business under New York law. The Company will continue to monitor and review guidance from the DFPI clarifying the enactment’s scope and interpretation.

• In 2024, the IRS issued final regulations and other guidance on tax reporting requirements for cryptocurrency brokers, which generally expanded the scope of companies that are required to report basis, adjusted basis, gross proceeds and amounts realized from sales of covered crypto assets.

•In early 2025, President Trump created a Working Group on Digital Asset Markets with the mandate of identifying existing regulations and other guidance that should be rescinded or modified and creating a new framework for digital asset regulation. The SEC has also created a Crypto Task Force designed to develop an SEC framework for regulation.

Governmental and regulatory bodies may continue to adopt new laws and regulations, issue new guidance or bring new enforcement actions relating to crypto and the crypto industry generally, and crypto platforms in particular, the direction and timing of which may be influenced by changes in the governing administrations and major events in the crypto industry. In particular, the new presidential and congressional administrations may be more likely to change the direction of policy, perhaps significantly. See “Risks Related to Crypto—Regulations governing crypto and blockchain may change rapidly, which may force us to change our business quickly to adapt and may change the competitive landscape.” In addition, regulators may establish self-regulatory bodies to set guidelines regarding crypto, which could have similar effects on new policies adopted by government bodies. To the extent regulators issue guidance, uncertainties may remain regarding the application of such guidance, and any informal guidance may not be an official policy, rule or regulation, may be subject to change and is not necessarily binding on the applicable regulators. Enforcement actions may also be contested in litigation, which could take years to resolve, or dropped by the new administration, which can also lead to an uncertain regulatory environment.

The technologies underlying crypto are novel technologies and relatively untested, and the application of securities and other laws to aspects of these technologies and crypto is unclear in certain respects. It is difficult to predict how or whether regulatory agencies may apply existing or new regulation with respect to this technology and its applications, and whether regulators will bring enforcement actions on specific issues. Further, U.S. bankruptcy courts have recently been faced with a number of questions of first impression that may determine the status of crypto in bankruptcy, and the rights and obligations of platforms that custody crypto for their customers. The law in this area continues to develop.

New interpretations of, or changes to, existing laws, regulations and guidance, and new enforcement actions, may impact, either positively or negatively, the development of the crypto industry as a whole and our legal and regulatory status in particular by changing how we operate our business, how our products and services are regulated, and what products or services we and our competitors can offer, requiring changes to our compliance and risk mitigation programs and other policies and procedures, imposing new licensing or registration requirements and associated compliance, imposing a total ban on certain crypto transactions, or opening up regulatory paths for additional transactions or activities, as has occurred in certain jurisdictions in the past. In addition, new or changing laws, regulations, guidance or enforcement actions, could severely or materially adversely impact, among other things, the permissibility of the operation of the blockchain networks underlying crypto and our operations; adversely impact the value or liquidity of crypto; the ability to access marketplaces or exchanges on which to trade crypto; the structure, rights and transferability of crypto and the treatment of crypto and holders of crypto in

-56- insolvency proceedings; and publicity relating to particular crypto assets or platforms or the crypto industry more generally. In addition, new laws, regulations, guidance, or approaches to enforcement that permit a broader range of transactions and activities or are otherwise designed to support the crypto market could encourage additional entrants into the market and foster more competition. These developments may also force us to adapt our business quickly, and our success and profitability may depend on our ability to do so effectively. Any of the foregoing could significantly adversely impact our business.

The cost of compliance with the ever-changing legal and regulatory environment may be significant, including for Bakkt Crypto, which is subject to various obligations pursuant to its licenses. Our failure to comply with existing or future laws, rules and regulations could subject us to fines, civil liability, mandatory injunctions that change how we operate or cessation of operations. We may be forced to implement new measures to reduce our exposure to this liability, which may require us to expend substantial resources or to discontinue certain products or services, which would negatively affect our business. Any costs incurred to prevent or mitigate this potential liability could result in reputational harm and affect our financial condition and cash flows, thereby harming our business and results of operations. Relatedly, any loss of license or failure to secure a license that we need may cause a disruption to our business and operations.

See also “—Regulations governing crypto and blockchain may change rapidly, which brings uncertainty and may force us to change our business quickly to adapt,” and “—Risks Related to Regulation, Taxation and Law—A crypto asset’s status as a “security” in any relevant jurisdiction is subject to a high degree of uncertainty, and if crypto assets on our platform are later determined to be securities, we may be subject to regulatory scrutiny, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition.”

A crypto asset’s status as a “security” in any relevant jurisdiction may be subject to a high degree of uncertainty, and if crypto assets on our platform are later determined to be securities, we may be subject to regulatory scrutiny, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition.

The SEC and its staff have historically taken the position that certain crypto assets or transactions in them fall within the definition of a “security” under the U.S. federal securities laws, and it is possible the SEC may take this position with respect to assets that may be transacted on our platform. Certain legal tests for determining whether any given asset is a security currently may require highly complex and fact-driven analyses, and the outcome of any court or regulator’s assessment can be difficult to predict. In the past, the SEC, as well as other regulators, was increasingly focused on the regulation of crypto assets and activities, and that focus impacted our business. The SEC has alleged a number of additional crypto assets to be securities in the course of enforcement actions and lawsuits brought against crypto market participants, including lawsuits brought against the crypto exchanges Bittrex, Coinbase, Binance, and Kraken. Some of these actions have been and may in the future be dismissed or paused in light of changes in the regulatory approach of the SEC regarding crypto. Among the crypto assets identified as securities in these actions are assets that are listed on Bakkt Crypto’s platform. Particularly in 2025’s changing regulatory environment for crypto, it is not clear what actions the SEC will take with respect to those or other crypto assets, including what decisions the courts will reach regarding the status of specific crypto assets as securities. For example, in December 2020, the SEC initiated a lawsuit against Ripple and two of its executives, alleging that they engaged in the unlawful offer and sale of unregistered securities through sales of XRP, Ripple’s crypto asset, since 2012. On July 13, 2023, a court in the Southern District of New York held that Ripple’s sales of XRP to sophisticated investors pursuant to written contracts did constitute the unregistered offer and sale of investment contracts while sales of XRP to purchasers through blind bid/ask transactions on crypto asset exchanges did not constitute the sale of unregistered securities. The litigation remains under appeal. There also remains a significant lack of clarity over whether individual crypto assets that purport to maintain a fixed or “stable” value relative to a fiat currency or other underlying asset, known as “stablecoins,” will be deemed to be “securities.”

The classification of an asset as a security under applicable law has wide-ranging implications for the regulatory obligations that flow from the offer, sale, trading and clearing of such assets. For example, an asset that is a security in the United States may generally only be offered or sold in the United States pursuant to a registration

-57- statement filed with the SEC or in an offering that qualifies for an exemption from registration. Persons that effect transactions in assets that are classified as securities in the United States may be subject to registration with the SEC and states in which they offer and sell securities as a “broker” or “dealer” and subject to the corresponding rules and regulations of the SEC, relevant states and self-regulatory organizations, including FINRA. Platforms that bring together buyers and sellers of assets that are classified as securities in the United States constitute securities exchanges and will be either required to register as such with the SEC, or to operate pursuant to an exemption, as an alternative trading system (“ATS”).

We could be subject to legal or regulatory action in the event the SEC, a foreign regulatory authority, or a court were to determine that a supported crypto asset bought, sold, converted, spent or sent through our platform is a “security” under applicable laws. Because our platform is not yet registered or licensed with the SEC or foreign authorities as a broker-dealer, national securities exchange, or ATS (or foreign equivalents), and we do not seek to register or rely on an exemption from such registration or license to facilitate the offer and sale of crypto assets on our platform, we currently only permit transactions in crypto assets that we have determined are not securities. We intend to offer other crypto assets on our platform in the future, although which crypto assets will be allowed on our platform, and the timing for such crypto assets to be allowed on our platform, is uncertain. We will only allow those crypto assets for which we determine there are reasonably strong arguments to conclude that the crypto asset is not a security.

However, the application of securities laws to the specific facts and circumstances of crypto may be complex and subject to change, and a listing determination does not guarantee any conclusion under the United States federal securities laws. While we have policies that are designed to help us analyze whether a particular crypto asset is a “security”, our policies and procedures are not a legal standard, but rather a framework for analysis that permits us to make a risk-based assessment regarding the likelihood that a particular crypto asset could be deemed a “security” under applicable laws. Regardless of our conclusions, we could be subject to legal or regulatory action in the event the SEC, a state or foreign regulatory authority, or a court, were to determine that a crypto asset currently offered, sold or traded on our platform is a “security” under applicable laws. Moreover, although we expect our risk assessment policies and procedures to regularly evolve to take into account developments in case law, facts and developments in technology, regulatory clarity and changes in market acceptance and adoption of these crypto assets, these developments and changes may occur more rapidly than we are able to change our related policies and procedures. Actions may also be brought by private individuals or entities alleging illegal transactions involving crypto assets that they claim are securities, and seeking rescission of those transactions, and/or other legal and equitable relief under federal or state securities laws.

There can be no assurances that we will properly characterize any given crypto asset as a security or non-security for purposes of determining if that crypto asset is allowed to be offered through our platform, or that the SEC, foreign regulatory authority, or a court, if the question was presented to it, would agree with our assessment. If the SEC, foreign regulatory authority, or a court were to determine that bitcoin or any other crypto asset to be offered, sold, or traded on our platform in the future is a security, we would not be able to offer such crypto asset for trading until we are able to do so in a compliant manner, such as through an alternative trading system approved to trade crypto assets that constitute securities, and such determination may have adverse consequences for such supported crypto assets. A determination by the SEC, a foreign regulatory authority, or a court that an asset that we support for trading on our platform constitutes a security may also result in a determination that we should remove such asset from our platform, as well as other assets that have similar characteristics to such asset deemed to be a security. In addition, we could be subject to judicial or administrative sanctions for failing to offer or sell the asset in compliance with the registration requirements, or for acting as a broker, dealer, or national securities exchange without appropriate registration. Similarly, the SEC has recently alleged that certain crypto asset exchanges have acted without appropriate registration as clearing agencies. Although our platform functions differently from those alleged to have functioned as unregistered clearing agencies in actions brought by the SEC to date, we could face a similar action if the SEC and its staff take a different position with respect to our activities. An action for failure to register as a broker, dealer, national securities exchange, or clearing agency when such registration was required could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines and disgorgement, criminal liability and reputational harm. Customers that traded such supported assets on our platform and suffered

-58- trading losses could also seek to rescind a transaction that we facilitated on the basis that it was conducted in violation of applicable law, which could subject us to significant liability.

Furthermore, if we remove any assets from trading on our platform, our decision may be unpopular with our customers and may reduce our ability to attract and retain customers, especially if such assets remain traded on unregulated exchanges, which includes many of our competitors.

Finally, it is possible that the SEC’s approach to whether particular crypto assets are securities will change, perhaps significantly. If so, that could change the scope of the crypto assets that may be traded on our platform, and we may be required to adapt quickly. This could also allow and encourage new entrants into the market, which would increase competition and potentially detract from our market share and therefore our trading volume. In addition, certain entrants may choose to list crypto assets that we believe are properly deemed securities based on a perception that regulators are less likely to pursue enforcement or other penalties. This could also affect our market share and negatively impact our business.

We are subject to significant litigation risk and risk of regulatory liability and penalties. Any current or future litigation or regulatory proceedings against us could be costly and time-consuming to defend.

We are from time to time subject to legal proceedings and claims as well as regulatory proceedings that arise in the ordinary course of business, such as securities class action litigation or other shareholder litigation, claims brought by our clients or customers in connection with commercial disputes, or employment claims made by our current or former employees, and patent litigation. For example, even though the cases were ultimately dismissed, we incurred significant litigation costs in connection with lawsuits related to the VIH Business Combination. In addition, prior to our acquisition of Bakkt Crypto, Bakkt Crypto received requests from the SEC for documents and information about certain aspects of its business, including the operation of its trading platform, processes for listing assets, the classification of certain listed assets, and relationships with customers and service providers, among other topics. We timely responded to the SEC’s requests and on March 3, 2025, the SEC concluded its inquiry and, based on the information it had at such time, the SEC advised us that it did not intend to recommend an enforcement action against Bakkt Crypto.

Many aspects of our business involve substantial litigation risks, including potential liability from disputes over terms of a trade, the claim that a system failure or delay caused monetary losses to a customer, that we entered into an unauthorized transaction, that we provided materially false or misleading statements in connection with a transaction or that we failed to effectively fulfill our regulatory oversight responsibilities. We may be subject to disputes regarding the quality of customer order execution, the settlement of customer orders or other matters relating to our services.

Litigation, even claims without merit, could result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, financial condition and results of operations. Insurance may not cover such claims, may not provide sufficient payments to cover all the costs to resolve one or more such claims, and may not continue to be available on terms acceptable to us (including premium increases or the imposition of large deductible or co-insurance requirements). A claim brought against us that is uninsured or underinsured could result in unanticipated costs, potentially harming our business, financial position and results of operations. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms, or that our insurers will not deny coverage as to any future claim.

In light of our business model based on crypto, we are also subject to substantial regulatory risks. For more information about the regulatory risks to which our business is subject, see “—A crypto asset’s status as a “security” in any relevant jurisdiction is subject to a high degree of uncertainty, and if crypto assets on our platform are later determined to be securities, we may be subject to regulatory scrutiny, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition,” “—Regulatory regimes governing blockchain technologies and crypto are evolving and uncertain, and new legislation, regulations, guidance and enforcement actions have in the past required, and may in the future require, us to alter our business

-59- practices” and “—Our business is subject to extensive government regulation, oversight, licensure and approvals. Our failure to comply with extensive, complex, uncertain, overlapping and frequently changing rules, regulations and legal interpretations could materially harm our business.”

Adverse resolution of any lawsuit or claim or regulatory proceeding against us, or any regulatory investigation involving us, could have a material adverse effect on our business and our reputation. To the extent we are found to have failed to fulfill our regulatory obligations, we could lose our authorizations or licenses or become subject to conditions that could make future operations more costly and impair our profitability. Such events could also result in consumer dissatisfaction and a decline in consumers’ willingness to use our platform.

Bakkt Holdings, Inc. is a holding company, its only material asset is its interest in Opco, and it is accordingly dependent upon distributions made by its subsidiaries to pay taxes and expenses, make payments under the Tax Receivable Agreement and pay dividends.

Bakkt Holdings, Inc. is a holding company with no material assets other than our ownership of common units in Opco (“Opco Common Units”) and our managing member interest in Opco. As a result, it has no independent means of generating revenue or cash flow. Its ability to pay taxes and operating expenses, make payments under the Tax Receivable Agreement (the “Tax Receivable Agreement”) and pay dividends (if any) will depend on the financial results and cash flows of Opco and its subsidiaries and the distributions it receives from Opco. Deterioration in the financial condition, earnings or cash flow of Opco and its subsidiaries for any reason could limit or impair Opco’s ability to pay such distributions. Additionally, to the extent it needs funds and Opco and/or any of its subsidiaries are restricted from making such distributions under applicable law or regulation or under the terms of any financing arrangements, or Opco is otherwise unable to provide such funds, it could materially adversely affect Bakkt Holdings’ liquidity and financial condition.

Opco will continue to be treated as a partnership for U.S. federal income tax purposes and, as such, generally will not be subject to any entity-level U.S. federal income tax. Instead, taxable income will be allocated to holders of Opco Common Units. Accordingly, we will be required to pay income taxes on our allocable share of any net taxable income of Opco. Under the terms of the Third Amended and Restated LLC Agreement (the “Opco LLC Agreement”), Opco is obligated to make certain tax distributions to holders of Opco Common Units (including us). In addition to tax expenses, we will also incur other expenses, including payment obligations under the Tax Receivable Agreement, which could be significant. We intend to cause Opco to make distributions to holders of Opco Common Units, pro rata, in aggregate amounts sufficient to cover all of our applicable income taxes, payments required to be made by us under the Tax Receivable Agreement and dividends, if any, declared by us. However, Opco’s ability to make such distributions may be subject to various limitations and restrictions including, but not limited to, restrictions on distributions that would either violate any contract or agreement to which Opco is then a party, including debt agreements, or any applicable law, or that would have the effect of rendering Opco insolvent. If our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement and to fund our obligations, we may be required to incur additional indebtedness to provide the liquidity needed to make such payments, which could materially adversely affect our liquidity and financial condition and subject us to various restrictions imposed by any such lenders. To the extent that we are unable to make payments under the Tax Receivable Agreement for any reason, such payments will be deferred and will accrue interest until paid; provided, however, that non-payment for a specified period may constitute a material breach of a material obligation under the Tax Receivable Agreement and therefore accelerate payments due under the Tax Receivable Agreement, which could be substantial.

Additionally, although Opco generally will not be subject to any entity-level U.S. federal income tax, it may be liable under federal tax legislation for adjustments to its tax return, absent an election to the contrary. In the event that the taxing authorities determine that Opco’s tax returns are incorrect, Opco and/or its members, including us, in later years may be subject to material liabilities pursuant to this federal legislation and its related guidance.

We anticipate that the distributions we will receive from Opco may, in certain periods, exceed our actual tax liabilities and obligations to make payments under the Tax Receivable Agreement. The Board, in its sole discretion, will make determinations with respect to the use of any such excess cash, which may include, among

-60- other uses to pay dividends, which may include special dividends, on the Class A Common Stock; to fund repurchases of Class A Common Stock; or any combination of the foregoing. We will have no obligation to distribute such cash (or other available cash other than any declared dividend) to our stockholders. To the extent that we do not distribute such excess cash as dividends on Class A Common Stock or otherwise undertake ameliorative actions between Opco Common Units and shares of Class A Common Stock and instead, for example, hold such cash balances, holders of Opco Common Units that hold interests in Opco may benefit from any value attributable to such cash balances as a result of their ownership of Class A Common Stock following an exchange of their Opco Common Units, notwithstanding that such holders may previously have participated as holders of Opco Common Units in distributions by Opco that resulted in such excess cash balances for us.

Opco is generally prohibited under Delaware law from making a distribution to a member to the extent that, at the time of the distribution, after giving effect to the distribution, liabilities of Opco (with certain exceptions) exceed the fair value of its assets. Opco’s subsidiaries are generally subject to similar legal limitations on their ability to make distributions to Opco.

Pursuant to the Tax Receivable Agreement, we are required to pay 85% of the net income tax savings we realize as a result of increases in the tax basis in Opco’s assets as a result of exchanges of Opco Common Units for Class A Common Stock (or cash) pursuant to the Amended and Restated Exchange Agreement (the “Exchange Agreement”), and those payments may be substantial.

The members of Opco (the “Opco Equity Holders”) may exchange their Opco Common Units for shares of Class A Common Stock (or cash) pursuant to the Exchange Agreement, subject to certain conditions and transfer restrictions as set forth therein and in the Opco LLC Agreement. These exchanges are expected to result in increases in our allocable share of the tax basis of the tangible and intangible assets of Opco. These increases in tax basis may increase (for income tax purposes) depreciation and amortization deductions and therefore reduce the amount of U.S. federal and applicable state income tax that we would otherwise be required to pay in the future had such exchanges never occurred.

We are party to the Tax Receivable Agreement, which generally provides for the payment by us of 85% of certain net tax benefits, if any, that we realize (or in certain cases are deemed to realize) as a result of these increases in tax basis and certain other tax attributes of Opco and tax benefits related to entering into the Tax Receivable Agreement, including tax benefits attributable to payments under the Tax Receivable Agreement. These payments are our obligation and not an obligation of Opco. The actual increase in our allocable share of Opco’s tax basis in its assets, as well as the amount and timing of any payments under the Tax Receivable Agreement, will vary depending upon a number of factors, including the timing of exchanges, the market price of the Class A Common Stock at the time of the exchange, the extent to which such exchanges are taxable and the amount and timing of the recognition of our income. While many of the factors that will determine the amount of payments that we will make under the Tax Receivable Agreement are outside of our control, the payments we will make under the Tax Receivable Agreement could be substantial and could have a material adverse effect on our financial condition. Estimating the amount and timing of payments that may become due under the Tax Receivable Agreement is, by its nature, imprecise. The amount and timing of any payments under the Tax Receivable Agreement are dependent upon significant future events, including those noted above in respect of estimating the amount and timing of our realization of tax benefits. The potential future tax savings that we will be deemed to realize, and the Tax Receivable Agreement payments made by us, will be calculated based on the market value of the Class A Common Stock at the time of each redemption or exchange under the Exchange Agreement and the prevailing tax rates applicable to us over the life of the Tax Receivable Agreement and will depend on us generating sufficient taxable income to realize the tax benefits that are subject to the Tax Receivable Agreement. Any payments made by us under the Tax Receivable Agreement will generally reduce the amount of overall cash flow that might have otherwise been available to us. To the extent that we are unable to make timely payments under the Tax Receivable Agreement for any reason, the unpaid amounts will be deferred and will accrue interest until paid; however, non-payment for a specified period may constitute a material breach of a material obligation under the Tax Receivable Agreement and therefore accelerate payments due under the Tax Receivable Agreement, which could be substantial, as further described below. Furthermore, our future obligation to make payments under the Tax Receivable Agreement could

-61- make it a less attractive target for an acquisition, particularly in the case of an acquirer that cannot use some or all of the tax benefits that may be deemed realized under the Tax Receivable Agreement.

In certain cases, payments under the Tax Receivable Agreement may exceed the actual tax benefits we realize or such payments may be accelerated.

Payments under the Tax Receivable Agreement will be based on the tax reporting positions that we determine, and the Internal Revenue Service (the “IRS”) or another taxing authority may challenge all or any part of the tax basis increases, as well as other tax positions that we take, and a court may sustain such a challenge. In the event any tax benefits initially claimed by us are disallowed, the current Opco Equity Holders will not be required to reimburse us for any excess payments that may previously have been made under the Tax Receivable Agreement, for example, due to adjustments resulting from examinations by taxing authorities. Rather, excess payments made to such holders will be netted against any future cash payments otherwise required to be made by us, if any, after the determination of such excess. However, a challenge to any tax benefits initially claimed by us may not arise for a number of years following the initial time of such payment or, even if challenged early, such excess cash payment may be greater than the amount of future cash payments that we might otherwise be required to make under the terms of the Tax Receivable Agreement and, as a result, there might not be future cash payments from which to net against. As a result, in certain circumstances we could make payments under the Tax Receivable Agreement in excess of our actual income tax savings, which could materially impair our financial condition.

Moreover, the Tax Receivable Agreement provides that, in the event that (a) we exercise our early termination rights under the Tax Receivable Agreement, (b) the Tax Receivable Agreement is rejected in a bankruptcy proceeding, (c) certain changes of control occur (as described in the Tax Receivable Agreement) or (d) we are more than thirty days late in making of a payment due under the Tax Receivable Agreement (unless we determine that we have insufficient funds to make such payment as a result of obligations imposed in connection with a senior obligation or applicable law), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Opco Equity Holders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income. The lump-sum payment to the Opco Equity Holders could be substantial and could exceed the actual tax benefits that we realize subsequent to such payment because such payment would be calculated assuming, among other things, that we would have certain tax benefits available to it, that we would be able to use the potential tax benefits in future years, and that tax rates applicable to us would be the same as they were in the year of the termination.

There may be a material negative effect on our liquidity if the payments under the Tax Receivable Agreement exceed the actual income tax savings that we realize. Furthermore, our obligations to make payments under the Tax Receivable Agreement could also have the effect of delaying, deferring or preventing certain mergers, asset sales, other forms of business combinations or other changes of control. We may need to incur additional indebtedness to finance payments under the Tax Receivable Agreement to the extent our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement as a result of timing discrepancies or otherwise.

We may have to constrain our business activities to avoid being deemed an investment company under the Investment Company Act.

In general, a company that is or holds itself out as being engaged primarily in the business of investing, reinvesting, or trading in securities may be deemed to be an investment company under the Investment Company Act. The Investment Company Act contains substantive legal requirements that regulate the manner in which “investment companies” are permitted to conduct their business activities. We believe we have conducted, and intend to continue to conduct, our business in a manner that does not result in us being characterized as an investment company. To avoid being deemed an investment company, we may decide not to broaden our offerings, which could require us to forgo attractive opportunities. If we are deemed to be an investment company under the Investment Company Act, we would be required to institute burdensome compliance requirements and our activities

-62- would be restricted, which would adversely affect our business, financial condition and results of operations. In addition, we may be forced to make changes to our management team if we are required to register as an investment company under the Investment Company Act.

We are subject to anti-money laundering and counter terrorist financing laws and regulations, globally, including the USA PATRIOT Act (as defined below), and failure to comply with such laws and regulations may subject us to liability. There can be no assurance that our employees or agents will not violate such laws and regulations.

We are subject to anti-money laundering and counter terrorist financing laws and regulations globally, including the BSA, as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (“USA PATRIOT Act”), the regulations promulgated by FinCEN, as well as economic and trade sanctions programs, including those imposed and administered by OFAC. Anti-money laundering laws and regulations generally prohibit, among other things, our involvement in transferring the proceeds of criminal activities. The USA PATRIOT Act requires us to, among other things, develop, implement and maintain an anti-money laundering program, report suspicious activities and transactions to FinCEN, comply with certain reporting and recordkeeping requirements, and collect and maintain information about customers. Under OFAC’s economic sanctions program, we are prohibited from financial transactions and other dealings with certain countries and geographies and with persons and entities included in OFAC sanctions lists, including its list of Specially Designated Nationals and Blocked Persons.

There can be no assurance that our employees or agents will not violate such anti-money laundering and counter terrorist financing laws and regulations, and economic and trade sanctions programs. A failure by us or our employees or agents to comply with such laws and regulations and subsequent judgment or settlement against us under these laws could subject us to criminal and/or civil liability, monetary penalties, damages and/or have a significant reputational impact, and a result in a material adverse effect to our business and operations.

Failure to comply with anti-bribery and anti-corruption laws and similar laws could subject us to penalties and other adverse consequences.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977 (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, and possibly other anti-bribery and anti-corruption laws in countries outside of the United States where we conduct our activities. Anti-corruption and anti-bribery laws are enforced aggressively and are interpreted broadly to generally prohibit companies, their employees, agents, representatives, clients, and third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector.

We may leverage third parties to sell our products and conduct our business abroad. We, our employees, agents, representatives, clients and third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these employees, agents, representatives, clients or third-party intermediaries even if we do not explicitly authorize such activities. We cannot assure you that all of our employees, agents, representatives, clients or third-party intermediaries will not take actions in violation of applicable law for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.

These laws also require that we keep accurate books and records and maintain internal controls and compliance procedures designed to prevent any such actions. While we have implemented policies and procedures designed to ensure compliance with these laws and regulations, there can be no assurance that none of our employees, agents, representatives, clients or third-party intermediaries will not violate our policies or applicable laws and regulations, for which we may be ultimately held responsible.

Any allegations or violation of the FCPA or other applicable anti-bribery and anti-corruption laws could result in whistleblower complaints, sanctions, settlements, prosecution, enforcement actions, fines, damages, adverse

-63- media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from government contracts, all of which may have an adverse effect on our reputation, business, results of operations, and prospects. Responding to any investigation or action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees.

We are subject to federal and state consumer protection laws and regulations in the jurisdictions in which we operate, which may result in liability or expense, including potential private rights of action, if we do not comply, or it is alleged that we do not to comply, with such laws.

We are subject to federal and state consumer protection laws and regulations in the jurisdictions in which we operate. In the United States, Bakkt Crypto is subject to federal and state consumer protection laws and regulations applicable to its activities, including potentially the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the CFPB. These regulations require us to provide advance disclosure of changes to our services, follow specified error resolution procedures and reimburse consumers for losses from certain transactions not authorized by the consumer, among other requirements. There are uncertainties associated with being subject to consumer protection rules and regulations of the CFPB and other regulators, including in the application of certain rules and regulations to our business model and to crypto. Bakkt Crypto may be considered a “covered person” for purposes of the CFPB’s enforcement authority and may additionally be subject to the authority of the Federal Trade Commission. Under certain consumer protection rules and regulations, we may be exposed to significant liability to consumers in the event that there is an incident which results in a large number of unauthorized and fraudulent transfers out of our system. Additionally, we could face private litigation by consumers under consumer protection laws and regulations that have private rights of action. Technical violations of consumer protection laws could result in the assessment of actual damages or statutory damages or penalties of up to $1,000 in individual cases or up to $500,000 per violation in any class action and treble damages in some instances; we could also be liable for plaintiffs’ attorneys’ fees in such cases. We could be subject to, and could be required to pay amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices.

Complying with evolving privacy and other data related laws and requirements may be expensive and force us to make changes to our business, and failure to comply with such laws and requirements could result in substantial harm to our business.

We are subject to a number of laws, rules, directives and regulations relating to the collection, use, retention, security, transfer and other processing of personal information about our consumers, employees, and other individuals (“privacy and security obligations”) in the jurisdictions where we operate. Our business relies on the processing of data and the movement of data, and, as a result, much of the personal information that we process, especially financial information, may be regulated by multiple privacy and security obligations. In many cases, these privacy and security obligations apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries and other parties with which we have commercial relationships. Regulatory scrutiny of privacy, data protection, cybersecurity and the collection, storage, use and sharing of personal information is increasing across multiple jurisdictions.

Furthermore, laws relating to privacy, data protection and cybersecurity, including with respect to the use of data in connection with artificial intelligence and machine learning, are rapidly evolving, extensive, complex and include inconsistencies and uncertainties. Examples of recent and anticipated developments that have or could impact our business include the following:

• The California Consumer Privacy Act (“CCPA”), as amended and supplemented by the California Privacy Rights Act (“CPRA”), provides California residents with certain privacy rights and protections with respect to certain sensitive personal information, including the ability to opt out of sales of their personal information. The CPRA also creates a new state agency that, along with the California Attorney General, has authority to implement and enforce the CCPA and the CPRA.

-64-

• Numerous other U.S. states are considering, and in certain cases have adopted, laws similar to the CCPA. For example, legislation similar to the CCPA has been adopted in Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Montana, Tennessee, Oregon, Florida, Delaware, Texas, New Jersey, Maryland, Minnesota, Nebraska, New Hampshire, Kentucky, and Rhode Island. Other U.S. states have adopted privacy laws addressing biometrics, financial privacy, and other matters. The U.S. federal government has also considered privacy legislation. These and other new and evolving laws could have potentially conflicting requirements that would make compliance challenging.

• The United States government is considering regulating artificial intelligence and machine learning, and legislation regulating certain aspects of artificial intelligence and machine learning has been proposed, and in certain cases adopted, in U.S. states.

• The certifications we maintain and the standards we comply with, including the Payment Card Industry Data Security Standard, among others, are becoming more stringent.

• More recently, the DOJ recently issued a final rule which takes effect in April 2025 that places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to data and business partners located in China or with other specified links to China (and other designated countries).

These and other similar legal and regulatory developments could contribute to legal and economic uncertainty, affect how we design, market, sell and operate our platform, how our clients, customers and vendors process and share data, how we process and use data, and how we transfer personal information from one jurisdiction to another, which could negatively impact demand for our platform. We may incur substantial costs to comply with privacy and security obligations, to meet the demands of our clients relating to their own compliance with applicable privacy and security obligations, and to establish and maintain internal policies, self-certifications and third-party certifications supporting our compliance programs. Our clients may delegate their privacy and security obligations relating to these or other laws or regulations to us via contract, and may impose additional obligations upon us via contract. More generally, we may be required to expend resources to assist our clients with such compliance obligations and to comply with our contractual obligations to our clients. In addition, any actual or perceived non-compliance with applicable laws, regulations, policies, industry data protections, security standards, certifications, and other actual or alleged privacy and security obligations or other undertakings relating to privacy or cybersecurity could result in proceedings, investigations, or claims against us by regulatory authorities, consumers, clients, or others, leading to reputational harm, significant fines, litigation costs, damages and other liabilities. Furthermore, many foreign countries and governmental bodies have laws and regulations concerning the collection, use, storage, deletion and other processing of personal information obtained from their residents or by businesses operating within their jurisdiction. These laws and regulations often are more restrictive than those in the United States. As we expand our business activities into jurisdictions beyond the United States, including as a result of the Bakkt Crypto acquisition, our practices, offerings, or platform could fail, or be alleged to fail to meet applicable privacy and security obligations in the jurisdictions in which we operate. All of these impacts could have a material adverse effect on our business, financial condition and results of operations.

We may at times fail to comply with our privacy policies or other notices or statements we may make regarding the collection, use, disclosure and other processing of personal information, including credit card information, and certain other information or may be perceived to have failed to do so. We may also not be successful in achieving compliance if our employees or vendors fail to comply with our policies, certifications, documentation, notices and statements. Such failures can subject us to potential investigations, enforcement actions or other proceedings if they are found to be deceptive, unfair or misrepresentative of our actual practices.

In addition, because of the large number of text messages, emails, phone calls and other communications we send or make to our consumers for various business purposes, communication-related privacy laws that provide a specified monetary damage award or fine for each violation could result in particularly significant damage awards or fines. For example, under the Telephone Consumer Protection Act (“TCPA”), in the U.S., plaintiffs may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and courts may triple the damage

-65- award for willful or knowing violations. We could be subject to lawsuits (including class-action lawsuits) containing allegations that our business violated the TCPA. These lawsuits seek damages (including statutory damages) and injunctive relief, among other remedies. Given the large number of communications we send to our consumers, a determination that there have been violations of the TCPA or other communications-based statutes could expose us to significant damage awards that could, individually or in the aggregate, materially harm our business.

We may be unable to sufficiently protect our proprietary rights and may encounter disputes from time to time relating to our use of the intellectual property of third parties.

We rely on a combination of trademarks, patents, service marks, copyrights, trade secrets, domain names and agreements with employees and third parties to protect our proprietary rights. Nonetheless, third parties may challenge, invalidate or circumvent our intellectual property, and our intellectual property may not be sufficient to provide it with a competitive advantage.

Despite our efforts to protect these rights, unauthorized third parties may attempt to duplicate or copy the proprietary aspects of our technology and processes. Our competitors and other third parties independently may design around or develop similar technology or otherwise duplicate our services or products such that we could not assert our intellectual property rights against them. In addition, our contractual arrangements may not effectively prevent disclosure of our intellectual property and confidential and proprietary information or provide an adequate remedy in the event of an unauthorized disclosure. Measures in place may not prevent misappropriation or infringement of our intellectual property or proprietary information and the resulting loss of competitive advantage, and we may be required to litigate to protect our intellectual property and proprietary information from misappropriation or infringement by others, which is expensive, could cause a diversion of resources and may not be successful.

We also may encounter disputes from time to time concerning intellectual property rights of others, and we may not prevail in these disputes. Third parties may raise claims alleging that we, or consultants or other third parties retained or indemnified by us, infringe on their intellectual property rights. Given the complex, rapidly changing and competitive technological and business environment in which we operate, and the potential risks and uncertainties of intellectual property-related litigation, an assertion of an infringement claim against us may cause us to spend significant amounts to defend the claim, even if we ultimately prevail, pay significant money damages, lose significant revenues, be prohibited from using the relevant systems, processes, technologies or other intellectual property (temporarily or permanently), cease offering certain products or services, or incur significant license, royalty or technology development expenses.

Regulatory requirements upon a change of control of our regulated subsidiaries may require an investor to obtain prior approval or submit information to regulators upon acquiring a direct or indirect controlling interest in us.

Certain of our subsidiaries are subject to regulatory supervision, including the requirement to obtain prior consent from the relevant regulator when a person holds, acquires or increases a controlling interest in those entities. For instance, under certain state money transmitter regulations, no person may hold or acquire, alone or together with others, a direct or indirect stake of 10% or more of us, or exercise, directly or indirectly, a controlling influence over us or any of the regulated subsidiaries. Under other state money transmitter regulations, that threshold may be higher. Such regulatory requirements may deter or delay an investor from acquiring a direct or indirect controlling interest in us or may make the closing of such a proposed investment subject to regulatory uncertainty.

Non-compliance with those requirements may lead to injunctions, penalties and sanctions against us as well as the person seeking to hold, acquire or increase a controlling interest, may subject the relevant transactions to cancellation or forced sale, and may result in increased regulatory compliance requirements or other potential regulatory restrictions on our business (including in respect of matters such as corporate governance, restructurings, mergers and acquisitions, financings and distributions). If any of this were to occur, it could damage our reputation, limit our growth and materially and adversely affect our business, financial condition and results of operations.

-66-

Our tax information reporting obligations with respect to transactions involving loyalty points or other incentives are subject to change.

Under the current law, we do not believe that we are required to file any information returns with taxing authorities with respect to the issuance by our clients of loyalty points or other incentives, and we believe that we are in compliance with our tax information reporting obligations with respect to incentives that we issue. There can be no assurance that the IRS will not challenge our position, or that the applicable laws and administrative guidance will not change in a manner requiring us to provide additional tax information reporting to our customers.

Additionally, changes in applicable laws and administrative guidance could impose such obligations on us. For example, under the Infrastructure Investment and Jobs Act of 2021 (Pub. L. 117-58) (the “Infrastructure Act”), we may be treated as a “broker” with respect to crypto transactions we facilitate. As a result, we may be required to file certain information reports, including customer’s names and addresses, gross proceeds from sales, and any capital gains or losses to the IRS. In 2024, the IRS issued final regulations and other guidance on tax reporting requirements for cryptocurrency brokers, which were intended to implement the changes in law enacted by the Infrastructure Act. Such changes in our tax information reporting obligations may have a negative effect on the experience of our customers and may significantly increase our compliance costs. As a result of the foregoing, our planned business model may be adversely affected or it may incur additional costs in connection therewith.

Changes in tax laws or their judicial or administrative interpretations, or becoming subject to additional taxes that cannot be passed through to our loyalty customers, could negatively affect our business, financial condition and results of operations.

Our operations may be subject to extensive tax liabilities, including federal and state income taxes and other taxes, such as excise, sales/use, payroll, franchise, withholding and ad valorem taxes. Changes in tax laws or their judicial or administrative interpretations could decrease the amount of revenues we receive, the value of any tax loss carryforwards and tax credits recorded on our balance sheet and the amount of our cash flow and may have a material adverse impact on our business, financial condition and results of operations. Some of our tax liabilities may be subject to periodic audits by the applicable taxing authority, which could increase our tax liabilities. Furthermore, we may become subject to taxation in various taxing jurisdictions. If we are required to pay additional taxes and are unable to pass the tax expense through to our customers, our costs would increase and our net income would be reduced, which could have a material adverse effect on our business, financial condition and results of operations.

Because there is limited guidance for tax reporting or accounting of bitcoin and other crypto transactions, the determination that we have made for how to account for or report the tax treatment of crypto transactions may be subject to change and challenge by relevant tax authorities in various countries, including the United States. Failure to properly report activity related to crypto for tax or accounting purposes may have negative regulatory or legal outcomes and harm our reputation.

Because there has been limited guidance for the tax reporting or accounting of crypto and limited guidance has been provided by the IRS, it is unclear how crypto transactions or other actions related to crypto (such as forks, provision of staking rewards and other crypto incentives and rewards products or other similar items) and related tax consequences should be accounted for or reported for tax purposes. In 2014, the IRS released Notice 2014-21, IRB 2014-16, or IRS Notice, discussing certain aspects of “convertible virtual currency” (that is, crypto currency that has an equivalent value in real (or fiat) currency or that acts as a substitute for fiat currency) for U.S. federal income tax purposes. IRS stated that such crypto currency is treated as “property”, not “currency” for purposes of the rules relating to foreign currency gain or loss, and may be held as a capital asset. In 2019, the IRS released Revenue Ruling 2019-24 and a set of “Frequently Asked Questions”, or the 2019 Revenue Ruling & FAQs, that provide some additional guidance, including guidance to the effect that, under certain circumstances, hard forks of crypto currencies are taxable events giving rise to ordinary income and guidance with respect to the determination of the tax basis of crypto currency. In 2023, the IRS released Revenue Ruling 2023-14, or the 2023 Revenue Ruling, that provides a cash-method taxpayer that receives additional units of crypto from staking must include those rewards in gross income. However, the IRS Notice, the 2019 Revenue Ruling & FAQs and the 2023 Revenue Ruling do not

-67- address other significant aspects of the U.S. federal income tax treatment of crypto and related transactions. Furthermore, the accounting treatment for revenues from crypto transactions is currently under review and subject to change. Failure to properly account for and report the transactions and other items related to the crypto held by our consumers to relevant tax authorities, such as the IRS, could have negative outcomes for us and harm our reputation with consumers and others.

There can be no assurance that the IRS or other foreign tax authority will not alter its existing positions with respect to crypto in the future or that a court would uphold the treatment set forth in the existing IRS guidance. It is also unclear what additional guidance may be issued in the future on the treatment of existing crypto transactions and future crypto innovations for purposes of U.S. federal income tax or other foreign tax regulations. Any such alteration of existing IRS and foreign tax authority positions or additional guidance regarding crypto products and transactions could result in adverse tax consequences for holders of crypto and could have an adverse effect on the value of crypto and the broader crypto markets. Future technological and operational developments that may arise with respect to crypto currencies may increase the uncertainty with respect to the treatment of crypto currencies for U.S. federal income and foreign tax purposes. The uncertainty regarding tax treatment of crypto transactions impacts our customers, and could impact our business, both domestically and abroad.

In 2024, the IRS issued final regulations and other guidance on tax reporting requirements for cryptocurrency brokers. The IRS may introduce new rules related to our tax reporting and withholding obligations on our customer transactions in the future, possibly in ways that differ from our existing compliance protocols and where there is risk that we do not have proper records to ensure compliance for certain legacy customers. If the IRS determines that we are not in compliance with our tax reporting or withholding requirements with respect to customer crypto transactions, we may be exposed to significant penalties, which could adversely affect our financial position. We anticipate additional guidance from the IRS regarding tax reporting and withholding obligations with respect to customer crypto transactions that will likely require us to invest substantially in new compliance measures and may require significant retroactive compliance efforts, which could adversely affect our financial position. Similarly, it is likely that new rules for reporting crypto under the “common reporting standard” will be implemented on our international operations, creating new obligations and a need to invest in new onboarding and reporting infrastructure. Such rules are under discussion today by the member and observer states of the “Organization for Economic Cooperation and Development” (the “OECD”) and may give rise to potential liabilities or disclosure requirements for prior customer arrangements and new rules that affect how we onboard our customers and report their transactions to taxing authorities.

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations under U.S. or state tax law.

Under Section 382 of the Internal Revenue Code of 1986, as amended (the “Code”), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its net operating losses (“NOLs”) to offset future taxable income. The Company has not determined if it has experienced Section 382 ownership changes in the past and if a portion of its NOL carryforwards are subject to limitation. Future changes in our stock ownership, the causes of which may be outside of our control, could result in an ownership change under Section 382 of the Code. Any NOLs may also be subject to limitation under state laws.

In addition, under the 2017 Tax Cuts and Jobs Act, or Tax Act, federal NOLs arising in taxable years beginning after December 3, 2017 do not expire but may be utilized to offset no more than 80% of taxable income annually. We may be required to pay federal income taxes in future years despite having NOLs for federal income tax purposes. There is also a risk that due to statutory or regulatory changes, such as suspensions on the use of NOLs, or other unforeseen reasons, our NOLs could expire or otherwise be unavailable to offset future income tax. Based on state conformity or the lack thereof to the provisions in the Tax Act, as amended by the CARES Act, there is the potential that NOLs could expire or be unavailable to offset future income for state income tax purposes. For these reasons, we may not be able to realize a tax benefit from the use of any NOLs, whether or not we attain profitability.

-68-

We may be subject to various governmental export control and trade sanctions laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls.

In some cases, our platform may be subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and platform and other our activities may be subject to trade and economic sanctions, including those administered by the United States Department of the Treasury’s Office of Foreign Assets Control, or OFAC (collectively, “Trade Controls”). As such, a license may be required to make our platform available or to provide services to certain countries and end-users, and for certain end-uses. The process for obtaining necessary licenses may be time-consuming or unsuccessful, potentially causing delays in sales or losses of sales opportunities, and these licenses may not be issued. Trade Controls are complex and dynamic regimes and monitoring and ensuring compliance can be challenging. Although we have procedures in place designed to ensure our compliance with Trade Controls, any failure to comply could subject us to both civil and criminal penalties, including substantial fines, possible incarceration of responsible individuals for willful violations, possible loss of our export or import privileges, and reputational harm.

In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our software and services or could limit our customers’ ability to implement our platform in those countries. Changes in our platform or changes in export and import regulations in such countries may create delays in the introduction of our platform into international markets, prevent our customers with international operations from deploying our platform globally or, in some cases, prevent or delay the export or import of our software and services to certain countries, governments, or persons altogether.

Risks Related to Information Technology and Data

Actual or perceived cyberattacks, security incidents or breaches could result in serious harm to our reputation, business and financial condition.

Our business involves the collection, storage, processing and transmission of confidential information and customers’ personal information, including financial information and information about how customers interact with our platform. We have built our reputation on the premise that we offer customers a secure and convenient way to manage their crypto. We also maintain and process other information in our business, including our own proprietary, confidential or otherwise sensitive information, and information we maintain or otherwise process for third parties. An increasing number of organizations, including large merchants, businesses, technology companies and financial institutions, as well as government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on their websites, mobile applications and infrastructure.

The techniques used to obtain unauthorized, improper, or illegal access to systems and information (including customers’ personal information), disable or degrade service, or sabotage systems are constantly evolving and have become very complex and sophisticated, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. We may be unable to anticipate these techniques or to implement adequate preventative measures, and any cyberattack, breach or other security incident may take longer than expected to remediate or otherwise address. Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems or facilities through various means, including, but not limited to, hacking into our systems or facilities or those of our customers or vendors, and attempting to fraudulently induce users of our systems (including employees and customers) into disclosing customer names, passwords, payment card information, or other sensitive information, which may in turn be used to access our information technology systems, or to steal crypto stored by our customers. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage and insider threats. Certain efforts may be supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. The wars in Ukraine and the Middle East, and other geopolitical tensions and military conflicts, may increase the risks we and our vendors face from cyberattacks. Numerous and evolving cybersecurity threats, including advanced and persistent cyberattacks, cyberextortion, ransomware, denial-of-service attacks, spear phishing and

-69- social engineering schemes, the introduction of computer viruses, ransomware or other malware, and the physical destruction of all or portions of our information technology and infrastructure could compromise the confidentiality, availability and integrity of the information (including consumers’ personal information) in and being processed by our systems. Although we have developed systems and processes designed to protect information we manage, prevent data loss and other security breaches and to permit us to effectively respond to known and potential risks, and we expect to continue to expend significant resources to bolster these systems and processes, there can be no assurance that our security measures will provide absolute security or have prevented or will prevent breaches, security incidents or attacks, in particular, as the frequency and sophistication of cyberattacks increases.

Our information technology and infrastructure and those of our vendors (including data center and cloud computing providers) may be vulnerable to cyberattacks, security breaches and incidents and third parties may be able to access our customers’ personal information and/or proprietary information, banking, crypto and payment card information, or other confidential, proprietary, or otherwise sensitive information, stored on or accessible through those systems. We have experienced from time to time, and may experience in the future, security breaches or incidents due to human error, malfeasance, insider threats, system errors, bugs, vulnerabilities, or other causes. Actual or perceived breaches of, or incidents impacting our or our vendors’ security could, among other things:

• interrupt our operations;

• result in our systems or services being unavailable, disrupted or degraded;

• result in loss or unavailability of, or improper acquisition, use, disclosure or other processing of information (including consumers’ personal information) and actual or perceived violations of applicable laws, regulations, or other actual or asserted legal or contractual obligations;

• materially harm our reputation;

• result in significant liability claims, litigation, regulatory scrutiny, investigations and other proceedings, fines, penalties and other legal and financial exposure;

• cause us to incur significant remediation costs;

• lead to loss or theft of customer crypto or loyalty points and other harm to customers;

• lead to loss or theft of intellectual property;

• lead to loss of customer confidence in, or decreased use of, our products and services;

• result in significant compensation or contractual penalties from us to our customers as a result of losses to them or claims by them; and

We have expended and expect to continue to invest in resources to protect against privacy compromises and security breaches and incidents and may be required to redress problems caused by such matters. We have implemented remote and hybrid working protocols and offer work-issued devices to certain employees, but the actions of employees while working remotely may have a greater effect on the security of our infrastructure and networks and the information, including personal information, we process, including for example by increasing the risk of compromise to systems or information arising from employees’ combined personal and private use of devices, accessing our networks or information using wireless networks that we do not control, or the ability to transmit or store information outside of our secured network. Our employees’ or third parties’ intentional, unintentional or inadvertent actions may increase our vulnerability or expose us to security threats, such as

-70- ransomware or other malware or phishing attacks, and we may remain responsible for unauthorized access to, or loss, unavailability, alteration, destruction, acquisition, disclosure or other processing of information we or our vendors process or otherwise maintain. Also, cyberattacks, including on the supply chain, continue to increase in frequency and magnitude, and we cannot provide assurances that our preventative efforts have been or will be successful.

Financial services regulators in various jurisdictions have implemented authentication requirements for banks and payment processors intended to reduce online fraud, which could impose significant costs, require us to change our business practices, make it more difficult for new consumers to join us, and reduce the ease of use of our platform, which could harm our business. Our insurance policies may not be adequate to reimburse us for losses caused by security breaches or incidents. We also cannot be certain that our insurance coverage will be adequate for incurred cybersecurity liabilities, that insurance will continue to be available to us on economically reasonable terms, or at all, or that an insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, results of operations, and reputation.

Systems failures and resulting interruptions in the availability of our websites, applications, products or services could harm our business.

Our systems and those of our service providers and clients have experienced from time to time, and may experience in the future service interruptions or degradation because of hardware and software defects or malfunctions, insider threats, human error, earthquakes, hurricanes, floods, fires and other natural disasters, power losses, disruptions in telecommunications services, fraud, geopolitical tensions, and military or political conflicts (including the wars in Ukraine and the Middle East), terrorist attacks, computer viruses, ransomware or other malware, or other events. We have experienced from time to time, and may experience in the future, disruptions in our systems. In addition, as a provider of payments solutions and crypto trading and custody solutions, we are subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans and more rigorous testing of such plans, which may be costly and time-consuming to implement, and may divert our resources from other business priorities.

We have experienced and expect to continue to experience system failures, denial-of-service attacks and other events or conditions from time to time that interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services. These events have resulted and likely will result in loss of revenue. A prolonged interruption in the availability or reduction in the availability, speed, or functionality of our products and services could materially harm our business. Frequent or persistent interruptions in our services could cause current or potential clients to believe that our systems are unreliable, leading them to switch to competitors or to avoid or reduce the use of our platform, and could permanently harm our reputation. Moreover, if any system failure or similar event results in damages to our customers, these clients could seek significant compensation or contractual penalties from us for their losses, and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address, and could have other consequences described under the caption “—Actual or perceived cyberattacks, security incidents, or breaches could result in serious harm to our reputation, business and financial condition.” Further, frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties and mandatory and costly changes to our business practices, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

We also rely on facilities, components, applications and services supplied by third parties, including data center facilities and cloud storage services, which subjects us to risks in the nature of those discussed under the caption “—We face operational, legal and other risks related to our reliance on third party vendors, over which we have no control.” From time to time, such third parties may cease to provide us with such facilities and services. Additionally, if these third parties experience operational interference or disruptions, breach their agreements with us, fail to perform their obligations and meet our expectations, or experience a cyberattack, security incident or breach, our operations could be disrupted or otherwise negatively affected, which could result in consumer

-71- dissatisfaction, regulatory scrutiny and damage to our reputation and brands and materially and adversely affect our business. Our business interruption insurance coverage may be insufficient to compensate us for all losses that may result from interruptions in our service as a result of systems failures and similar events.

Implementation of new systems and technologies is complex, expensive and time-consuming. If we fail to timely and successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies, or if such systems and technologies do not operate as intended, this could have an adverse impact on our business, internal controls (including internal controls over financial reporting), results of operations and financial condition.

If we use open source software inconsistent with our policies and procedures or the license terms applicable to such software, we could be subject to legal expenses, damages, or costly remediation or disruption to our business.

We use open source software in our platform. While we have policies and procedures in place governing the use of open source software, there is a risk that we incorporate open source software with onerous licensing terms, including the obligation to make our source code available for others to use or modify without compensation. If we receive an allegation that we have violated an open source license, we may incur significant legal expenses, be subject to damages, be required to redesign our platform to remove the open source software, or be required to comply with onerous license restrictions, all of which could have a material impact on our business. Even in the absence of a claim, if we discover the use of open source software inconsistent with our policies, we could expend significant time and resources to replace the open source software or obtain a commercial license, if available. All of these risks are heightened by the fact that the ownership of open source software can be uncertain, leading to litigation, and many of the licenses applicable to open source software have not been interpreted by courts, and these licenses could be construed to impose unanticipated conditions or restrictions on our ability to commercialize our products. Any use of open source software inconsistent with our policies or licensing terms could harm our business and financial position.

Risks Related to Risk Management and Financial Reporting

In 2024, we identified a material weakness in our internal control over financial reporting. While we have remediated this material weakness as of the filing of this Form 10-K, other material weaknesses not yet identified could continue to adversely our ability to report our results of operations or produce timely and accurate financial statements, which could have a material adverse effect on our business.

In connection with the preparation of our financial statements for the period ended March 31, 2024, we identified a material weakness in our internal control over financial reporting relating to the review of the work performed by a third-party valuation specialist. The specialist was used in the valuation of our Class 1 Warrants and Class 2 Warrants issued in connection with the Concurrent Offerings.

During 2024, we remediated this material weakness discussed above and took additional steps to further improve our internal control environment. Any newly identified material weakness could limit our ability to prevent or detect a misstatement of our accounts or disclosures that could result in a material misstatement of our annual or interim financial statements. We cannot assure you that the measures we have taken to date, or any measures we may take in the future, will be sufficient to remediate and avoid potential future material weaknesses.

We have limited accounting and finance personnel and other resources and must develop our own internal controls and procedures consistent with SEC regulations. We intend to continue to evaluate actions to enhance our internal controls over financial reporting, but there is no assurance that we will not identify control deficiencies or material weaknesses in the future.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective internal control over financial reporting and disclosure controls and procedures. Pursuant to the Sarbanes-Oxley Act we are required to make a formal assessment of the effectiveness of our internal control over financial reporting and we will also be

-72- required to include an attestation report on internal control over financial reporting issued by our independent registered public accounting firm.

To comply with Section 404 of the Sarbanes-Oxley Act, we have incurred substantial cost, expended significant management time on compliance-related issues and hired additional accounting and financial staff with appropriate public company experience and technical accounting knowledge. These costs have increased now that we are required to provide an attestation report on internal controls over financial reporting. Moreover, if we are not able to comply with the requirements of Section 404 of the Sarbanes-Oxley Act in a timely manner or if we or our independent registered public accounting firm identify deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources.

Any failure to maintain effective disclosure controls and procedures or internal control over financial reporting could have an adverse effect on our business and operating results, and cause a decline in the price of our securities.

Real or perceived inaccuracies in our key operating metrics may harm our reputation and negatively affect our business.

We track certain key operating metrics with internal systems and tools that are not independently verified by any third party. While the metrics presented in this Form 10-K are based on what we believe to be reasonable assumptions and estimates, our internal systems and tools have a number of limitations, and our methodologies for tracking these metrics may change over time. In addition, limitations or errors with respect to how we measure data or with respect to the data that we measure may affect our understanding of certain details of our business, which could affect our long-term strategies. If the internal systems and tools we use to track these metrics understate or overstate performance or contain algorithmic or other technical errors, the key operating metrics we report may not be accurate. If investors do not perceive our operating metrics to be accurate, or if we discover material inaccuracies with respect to these figures, our reputation may be significantly harmed and our results of operations and financial condition could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the condensed financial statements and income and expenses during the periods reported. Actual results could materially differ from those estimates and the amounts reported in our consolidated financial statements and accompanying notes appearing elsewhere in this Form 10-K. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant estimates and judgments involve those related to going concern, revenue recognition, internal-use software development costs, valuation of our stock-based compensation awards, including the determination of fair value of our common stock, accounting for income taxes, the carrying value of operating lease right-of-use assets and useful lives of long-lived assets, among others. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the market price of our securities.

Certain of our executive officers and directors, including our Chief Executive Officer, have limited experience in the management of a publicly traded company. Such limited experience in dealing with the complex laws pertaining to public companies could be a disadvantage and result in a significant amount of their time being devoted to these activities, which will result in less time being devoted to our management and growth.

-73-

If members or former members of our management engage in business activities of the types conducted by us, we may be materially adversely affected.

Certain members and former members of our management and their affiliates have in the past provided management services to other finance and technology companies that may compete with us. Certain members and former members of our management have entered into restrictive covenant agreements with non-competition provisions. If these agreements are not effective in preventing these parties from engaging in business activities that are competitive with us, it could have a material adverse effect on our business, financial condition, results of operations or prospects.

We are a “smaller reporting company” and any decision to comply with certain reduced reporting and disclosure requirements applicable to smaller reporting companies could make our securities less attractive to investors.

We are a “smaller reporting company,” as defined in Regulation S-K of the Securities Act of 1933, as amended (the “Securities Act”), which allows us to take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not smaller reporting companies, including reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements.

If some investors find our securities less attractive because we rely on any of these exemptions, there may be a less active trading market for such securities and the market price of such securities may be more volatile and may decline.

Future changes in financial accounting standards may significantly change our reported results of operations.

GAAP is subject to standard setting or interpretation by the FASB, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results. For example, the accounting treatment for revenues from crypto transactions is under review and subject to change. To the extent we account for revenue from crypto transactions in a manner that is different than the manner ultimately established by the SEC and GAAP, such revenue information, and the timing of revenue recognition, could vary materially and require subsequent adjustment. Additionally, the SEC issued SAB 121, which significantly changed how a company safeguarding crypto assets held for its platform users reported such crypto assets on its balance sheet. In January 2025, the SEC rescinded SAB 121 through the adoption of SAB 122, which we have adopted as of December 31, 2024, on a retrospective basis. Any future adjustments could materially impact our regulatory capital requirements and our reported results of operations, which could have negative outcomes for us and harm our reputation and could affect the reporting of transactions completed before the announcement of a change.

Risks Related to Our Securities

We may issue additional shares of common stock or other equity securities, which would dilute stockholders’ ownership interest in us and may reduce the market price of our securities.

We may issue additional shares of our Class A Common Stock or other equity securities in the future in connection with, among other things, future acquisitions, repayment of outstanding indebtedness, the exercise of warrants issued pursuant to the Concurrent Offerings, or grants under the Omnibus Incentive Plan, without stockholder approval in a number of circumstances. The issuance of additional Class A Common Stock or other equity securities could have, among other things, one or more of the following effects:

• our existing stockholders’ proportionate ownership interest will decrease;

-74-

• the relative voting strength of each previously outstanding share of our common stock may be diminished; and

• the market price of our Class A Common Stock and/or Warrants may decline.

Our warrants are exercisable for Class A Common Stock. Any such exercise increases the number of shares outstanding and eligible for future resale in the public market and results in dilution to our stockholders.

As of December 31, 2024, our Public Warrants to purchase an aggregate of 285,619 shares of Class A Common Stock are exercisable in accordance with the terms of the warrant agreement. In addition, we have outstanding Class 1 Warrants and Class 2 Warrants to purchase up to an aggregate of 2,017,850 additional shares Class A Common Stock at an exercise price $25.50 per share. To the extent such warrants are exercised, additional shares of Class A Common Stock will be issued, which will result in dilution to the holders of Class A Common Stock and increase the number of shares eligible for resale in the public market. Sales of substantial numbers of such shares in the public market or the fact that such warrants may be exercised could adversely affect the market price of Class A Common Stock.

We may not receive any additional funds upon the exercise of the Warrants.

Our Class 1 Warrants and Class 2 Warrants may be exercised by way of a cashless exercise, meaning that the holder may not pay a cash purchase price upon exercise, but instead would receive upon such exercise the net number of shares of the Class A Common Stock as determined according to the formulas set forth in the Warrant. In addition, upon the occurrence of certain events, the Class 2 Warrants may be exercised by way of an alternative cashless exercise, allowing the holder to receive the product of (x) the aggregate number of shares subject to the alternative cashless exercise (up to the full number of shares that would be issuable upon exercise of the Class 2 Warrant in accordance with the terms of the Class 2 Warrant if such exercise were by means of a cash exercise rather than a cashless exercise) and (y) 0.5. Accordingly, we may not receive any additional funds upon the exercise of our Class 1 Warrants or our Class 2 Warrants.

The valuation of our warrants could increase the volatility in our net income (loss) in our consolidated statements of operations.

The change in fair value of our warrants is the result of changes in stock price and warrants outstanding at each reporting period. (Loss) gain from change in fair value of warrant liabilities represents the mark-to-market fair value adjustments to the outstanding warrants. Significant changes in our stock price or number of warrants outstanding may adversely affect our net income (loss) in our consolidated statements of operations.

If securities and industry analysts do not publish research or publish inaccurate or unfavorable research about our business, the prices and trading volumes of our securities could decline.

The trading market for our securities depends, in part, on the research and reports that securities and industry analysts publish about us and our business. If securities and industry analysts downgrade our securities or publish inaccurate or unfavorable research about our business, the market price of our securities would likely decline. If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our stock could decrease, which might cause the market price and trading volume of our securities to decline.

Our certificate of incorporation (the “Certificate of Incorporation”) and our by-laws (the “By-Laws”) contain provisions that could have the effect of rendering more difficult, delaying, or preventing an acquisition deemed undesirable by the Board and therefore depress the trading price of our securities. These provisions could also make it difficult for stockholders to take certain actions, including electing directors who are not nominated by

-75- the current members of the Board or taking other corporate actions, including effecting changes in management. Among other things, the Certificate of Incorporation and By-Laws include provisions regarding:

• a classified Board with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of the Board;

• the right of the Board to elect a director to fill a vacancy created by the expansion of the Board or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on the Board;

• the requirement that directors may only be removed from the Board for cause and upon the affirmative vote of the holders of at least 66 2/3% of the total voting power of then outstanding Class A Common Stock;

• a prohibition on stockholder action by written consent (except for actions by the holders of Class V Common Stock or as required for holders of future series of Preferred Stock), which forces stockholder action to be taken at an annual or special meeting of stockholders and could delay the ability of stockholders to force consideration of a stockholder proposal or to take action, including the removal of directors;

• the requirement that a special meeting of stockholders may be called only by the Board, the Chairman of the Board or our Chief Executive Officer, which could delay the ability of stockholders to force consideration of a proposal or to take action, including the removal of directors;

• the requirement for the affirmative vote of holders of at least 66 2/3% of the total voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend, alter, change or repeal certain provisions in the Certificate of Incorporation which could preclude stockholders from bringing matters before annual or special meetings of stockholders and delay changes in the Board and also may inhibit the ability of an acquirer to effect such amendments to facilitate an unsolicited takeover attempt;

• advance notice procedures with which our stockholders must comply to nominate candidates to the Board or to propose matters to be acted upon at a stockholders’ meeting, which could preclude stockholders from bringing matters before annual or special meetings of stockholders and delay changes in the Board and also may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control.

-76-

We cannot predict the impact our dual class structure may have on the stock price of our Class A Common Stock.

We cannot predict whether our dual class structure will result in a lower or more volatile market price of our Class A Common Stock or in adverse publicity or other adverse consequences. For example, certain index providers have considered restrictions on including companies with multiple-class share structures in certain of their indexes. Under these policies, our dual class capital structure may make us ineligible for inclusion in certain indices, and as a result, mutual funds, exchange-traded funds and other investment vehicles that attempt to passively track those indices will not be investing in our stock. It is unclear what effect, if any, these policies will have on the valuations of publicly traded companies excluded from such indices, but it is possible that they may depress valuations, as compared to similar companies that are included. As a result, the market price of shares for our Class A Common Stock could be adversely affected.

Our Certificate of Incorporation designates a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.

Our Certificate of Incorporation provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or if such court does not have subject matter jurisdiction, any other court located in the State of Delaware with subject matter jurisdiction, will be the sole and exclusive forum for (a) any derivative action or proceeding brought on behalf of us, (b) any action asserting a claim of breach of a fiduciary duty owed by any current or former director, officer, other employee or stockholder of ours to us or our stockholders, (c) any action asserting a claim against us or our officers or directors arising pursuant to any provision of the Delaware General Corporation Law (the “DGCL”) or the Certificate of Incorporation or By-Laws or as to which the DGCL confers jurisdiction on the Court of Chancery of the State of Delaware, (d) any action to interpret, apply, enforce or determine the validity of the Certificate of Incorporation or the By-Laws or any provision thereof, (e) any action asserting a claim against us or any current or former director, officer, employee, stockholder or agent of ours governed by the internal affairs doctrine of the law of the State of Delaware or (f) any action asserting an “internal corporate claim” as defined in Section 115 of the DGCL.

Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. Accordingly, both state and federal courts have jurisdiction to entertain such Securities Act claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, the Certificate of Incorporation provides that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the federal district courts of the United States of America shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act; however, there is uncertainty as to whether a court would enforce such provision, and investors cannot waive compliance with federal securities laws and the rules and regulations thereunder. Notwithstanding the foregoing, the Certificate of Incorporation provides that the exclusive forum provision will not apply to suits brought to enforce any cause of action arising under the Securities Act, any duty or liability created by the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities will be deemed to have notice of and consented to this provision. These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers and other employees. If a court were to find these exclusive-forum provisions to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

Our Certificate of Incorporation does not limit the ability of ICE to compete with us.

-77-

ICE and its affiliates engage in a broad spectrum of activities, including investments in the financial services and technology industries. In the ordinary course of its business activities, ICE and its respective affiliates may engage in activities where their interests conflict with our interests, or those of our other stockholders. Our Certificate of Incorporation provides that ICE and its affiliates (including any non-employee directors of ours appointed by ICE) have no duty to refrain from (1) engaging in and possessing interests in other business ventures of every type and description, including those engaged in the same or similar business activities or lines of business in which we now engage or propose to engage or (2) otherwise competing with us, on their own account, in partnership with, or as an employee, officer, director or shareholder of any other individual, corporation, general or limited partnership, limited liability company, joint venture, trust, association or any other entity. ICE also may pursue, in its capacity other than as directors of the Board, acquisition opportunities that may be complementary to our business and, as a result, those acquisition opportunities may not be available to us. In addition, ICE may have an interest in pursuing acquisitions, divestitures and other transactions that, in its judgment, could enhance its investment, even though such transactions might involve risks to our other stockholders. ICE will not be liable to us, our stockholders any of our affiliates for breach of any fiduciary duty solely by reason of the fact that they engage or have engaged in any such activities.

ICE may exert significant influence over us and its interests may conflict with yours or those of other stockholders in the future.

Each share of Class A Common Stock and Class V Common Stock entitles its holder to one vote on all matters presented to stockholders generally. Accordingly, ICE is able to exert significant influence over the election and removal of our directors and thereby significantly influence corporate and management policies, including potential mergers or acquisitions, payment of dividends, asset sales, amendments of our Certificate of Incorporation and By-Laws and other significant corporate transactions for so long as it retains significant ownership. This concentration of ownership may delay or deter possible changes in control, which may reduce the value of an investment in our securities. So long as ICE continues to own a significant amount of the combined voting power, even if such amount is less than 50%, ICE will continue to be able to strongly influence our decisions. While the Voting Agreement, dated October 15, 2021, by and between us and ICE (the “Voting Agreement”) limits ICE to vote only an aggregate of 30% of its voting power, such amount may result in substantial influence in voting matters. The Voting Agreement provides that this limitation on ICE’s voting power will terminate at such time as its ownership is less than a majority of the outstanding voting power, at which time ICE will be entitled to vote all of its voting shares, which may result in an increase in its potential influence.

Additionally, the ICE Credit Facility contains certain conditions and covenants, including negative covenants that restrict our ability to engage in certain transactions, which may limit our ability to respond to changes in business and economic conditions. Such negative covenants include, among other things, limitations on our ability and the ability of our subsidiaries to incur debt or liens, make investments (including acquisitions), sell assets and pay dividends on our capital stock. For additional detail, see Note 8 in our audited consolidated financial statements included in this Form 10-K.

The trading market for our securities has in the past been and could in the future be impacted by market volatility. The price of our securities may fluctuate due to a variety of factors, including:

• changes in the crypto industry;

• developments involving our competitors or other companies in our industries;

-78-

•rumors and market speculation involving crypto assets and the regulation thereof, or us or other companies in our industry;

• actions by stockholders;

• the exercise of warrants to purchase our securities;

• additions and departures of key personnel or members of the Board;

• the volume of our Class A Common Stock available for public sale; and

• general economic and political conditions, such as recessions, inflation, volatility in the markets, increases in interest rates, local and national elections, fuel prices, international currency fluctuations, corruption, political instability, pandemics or other public health emergencies and the wars in Ukraine and the Middle East, resulting sanctions imposed by the U.S. and other countries, and retaliatory actions taken by Russia in response to such sanctions.

These market and industry factors may materially reduce the market price of our securities regardless of our operating performance.

Because there are no current plans to pay cash dividends on the Class A Common Stock for the foreseeable future, you may not receive any return on investment unless you sell your Class A Common Stock at a price greater than what you paid for it.

We intend to retain future earnings, if any, for future operations, expansion and debt repayment and there are no current plans to pay any cash dividends for the foreseeable future. The declaration, amount and payment of any future dividends on shares of Class A Common Stock will be at the sole discretion of the Board. The Board may take into account general and economic conditions, our financial condition and results of operations, our available cash and current and anticipated cash needs, capital requirements, contractual, legal, tax and regulatory restrictions, implications of the payment of dividends by us to our stockholders or by our subsidiaries to us and such other factors as the Board may deem relevant. As a result, you may not receive any return on an investment in Class A Common Stock unless you sell your Class A Common Stock for a price greater than that which you paid for it.

-79-