Bakkt, Inc.

Each of our products is architected, deployed, and managed through a common controls environment designed to protect our customers' confidential information using a combination of administrative, physical, and technical controls. We maintain a comprehensive cyber security program, managed by a dedicated team of security professionals, leveraging multiple layers of defenses to protect our loyalty and crypto clients’ consumer data, as well as crypto wallets, including crypto that is kept in custody. Our administrative, technical, and physical controls include the use of separation of duties, physical and logical access controls, biometrics, hardware security modules, advanced cryptographic algorithms, dedicated

-26- security monitoring, and other controls to protect our environment and restrict unauthorized access. Additionally, we regularly utilize independent external parties to assess and provide added assurance that our products are designed appropriately and operating effectively. We currently maintain independent SSAE-18 SOC 1 Type II and SOC 2 Type II attestation reports for our crypto platform and SOC 2 Type II attestation reports for our loyalty platform. We also maintain compliance with the Payment Card Industry Data Security Standard (“PCI-DSS”) for in-scope systems where cardholder data is stored or processed. We comply with NYDFS cybersecurity requirements which impose requirements related to establishing a detailed cybersecurity plan, enacting a comprehensive cybersecurity policy, and maintaining an ongoing reporting system for cybersecurity events.

Regulation

International, federal and state laws and regulations apply to many key aspects of our business. Any actual or perceived failure to comply with these requirements may result in, among other things, revocation of required licenses or registrations, loss of approved status, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, private litigation, reputational harm, or constraints on our ability to continue to operate. We operate in a regulatory environment that is evolving rapidly and increasing in scope. For example, the new presidential administration and Congress have each taken initial steps to change regulation and provide additional regulatory clarity around crypto assets and transactions. As such, it is possible that current or future laws or regulations could be enacted, interpreted or applied in a manner that would support, prohibit, alter, or impair our existing or planned products and services, or that could require costly, time-consuming, or otherwise burdensome compliance measures, or could force us to change our business quickly to successfully compete with new or existing entrants in the industry. Further, additional laws and regulations may apply to our businesses as we expand outside of the United States in the future. For more information, please see our risk factors described in“Item 1A. Risk Factors Risks Related to Crypto and Risks Related to Regulation, Taxation and Laws”.

Regulation of Our Money Transmission Business. Bakkt Crypto maintains a money transmitter license in each jurisdiction in which it operates that requires such a license for its activities. In all other jurisdictions where Bakkt Crypto operates, we have established with the applicable licensing body that a money transmitter license is not required at this time. We will comply with new license requirements as they arise. Bakkt Crypto is also registered as a “Money Services Business” with FinCEN. These licenses and registrations subject us to, among other things, record-keeping requirements, reporting requirements, bonding requirements, limitations on the investment of customer funds, and examination by state and federal regulatory agencies. These licensing laws also address matters such as change in control, and regulatory approval of controlling shareholders, directors, and senior management of the licensed entity.

Regulation of Our Virtual Currency Business.

We are subject in certain jurisdictions to licensing and regulatory requirements as a result of offering our clients the ability to aggregate, buy, sell, convert, and send virtual currency through our platform. Consequently, we must comply with laws, rules and regulations promulgated by federal or state regulators in those jurisdictions in order to provide our services, including requirements related to capitalization, consumer protection, anti-money laundering, disclosure, reporting and examination, as well as supervisory guidance and requirements. Bakkt Crypto also has a virtual currency license (“BitLicense”) from the NYDFS, which subjects it to NYDFS's oversight with respect to business activities conducted in New York State and with New York residents, and a Louisiana virtual currency business activity license, which subjects it to oversight by the Louisiana Office of Financial Institutions with respect to its virtual currency business activity in Louisiana State and with Louisiana residents. In October 2023, the governor of California signed into law the

-27-

Digital Financial Assets Law (“DFAL”), which establishes a required licensing framework administered by the California Department of Financial Protection and Innovation (“DFPI”) for entities engaged in digital financial asset business activity in the state of California. We expect that our business will require licensure under the DFAL and will therefore take steps to obtain necessary licenses prior to the enactment’s effective date of July 1, 2026. The DFAL provides that the DFPI may issue a conditional license to companies, such as our subsidiaries, that maintain licenses to conduct virtual currency business activity in New York or hold a charter as a New York limited purpose trust company with approval to conduct a virtual currency business under New York law. We will continue to monitor and review guidance from the DFPI clarifying the enactment’s scope and interpretation.

The laws and regulations applicable to crypto are rapidly evolving and subject to interpretation and change. For instance, the SEC has indicated in various enforcement actions and other contexts that it considers certain crypto assets to constitute securities. In early 2025, however, some of the companies that were subject to such enforcement actions have disclosed that the SEC has informed them that those enforcement actions are being closed and will not be pursued. The SEC has yet to issue any formal regulation on this point, though it has put forth some guidance on overarching frameworks and relevant factors to consider in this analysis, and the recent formation of a Crypto Task Force at the SEC signals potentially significant change and additional regulatory clarity. Based on these changes, our crypto services offered through our platform may become subject to more, less, or changed regulation.

Privacy and Information Cybersecurity Regulations. Aspects of our operations or business are subject to laws and regulation in the United States and in foreign jurisdictions relating to privacy, data protection and cybersecurity. Accordingly, we publish our privacy policies and terms of service, which describe our practices concerning the use, protection, transmission, and disclosure of information. As our business continues to expand in the United States and beyond, and as laws and regulations continue to be passed and their interpretations continue to evolve in numerous jurisdictions, additional laws and regulations may become relevant to us.

Regulatory authorities around the world are considering numerous legislative and regulatory proposals concerning privacy, data protection and cybersecurity. In addition, the interpretation and application of these laws and regulations in the United States and elsewhere are often uncertain and in a state of flux. As our business continues to develop and expand, we continue to monitor the additional rules and regulations that may become relevant. For additional information regarding these laws and regulations and related risks, please see “Risk Factors Risks Related to Regulation, Taxation, and Laws Complying with evolving privacyand other data related laws and requirements may be expensive and force us to make changes to our business, and failure to comply with such laws and requirements could result in substantial harm to our business.”

Consumer Protection Regulation. The Consumer Financial Protection Bureau and other federal and state regulatory agencies, including the Federal Trade Commission, broadly regulate financial products, enforce consumer protection laws applicable to credit, deposit, prepaid products, and payments, and other similar products. Such agencies have broad consumer protection mandates, and they promulgate, interpret, and enforce laws, rules and regulations, including with respect to unfair, deceptive, and abusive acts and practices that may impact or apply to our business.

For example, under federal and state financial privacy laws and regulations, we must provide notice to consumers of our policies on sharing non-public information with third parties, among other requirements. In addition, under the Electronic Fund Transfer Act, we are required to disclose the terms of, and any fees applicable to, our electronic fund transfer services to consumers prior to their use of the service, among other requirements.

-28-

Anti-Money Laundering and Counter-Terrorism Regulation. We are subject to AML laws and regulations in the United States, including the BSA, as amended, and its implemented regulations enforced by FinCEN, as well as laws designed to prevent the use of the financial systems to facilitate terrorist activities. We have implemented a comprehensive AML compliance program designed to prevent our platform from being used to facilitate money laundering, terrorist financing, and other illicit activity. Our program is also designed to prevent our platform from being used to facilitate business in countries, or with persons or entities, included on designated lists promulgated by OFAC and equivalent authorities in other countries. Our AML compliance program is comprised of policies, procedures, reporting protocols, including reporting requirements for suspicious transactions, and internal controls, including the designation of a compliance officer, training for employees, and a regular independent review of the program. It is designed to address applicable legal and regulatory requirements and to assist in managing risk associated with money laundering and terrorist financing.

Indirect Regulatory Requirements. We maintain relationships with certain clients, including banks and other financial institutions in the United States, that are regulated by state, local and federal agencies. Because of these relationships, we may be subject to regulation by these institutions’ regulators, as well as examination should these regulators exercise their authorities under applicable law. In addition, the federal banking agencies have well established supervisory guidance for banks with respect to their relationships with third parties, which they updated in 2023. This guidance applies to us and our bank clients relative to the totality of our relationship, including with respect to strategies and goals, financial condition, risk management, information security and systems, operational resilience, audit rights, and performance benchmarks. We generally seek to account for these types of indirect regulatory requirements in our commercial agreements. We also have clients that are investments advisors. The SEC has recently proposed changes to its investment adviser custody rule, which could affect the terms upon which we can offer custody services to those clients.

Escheatment and Unclaimed Property Regulations. There is regulatory uncertainty regarding how states and jurisdictions treat virtual currencies and other crypto assets under unclaimed property laws and regulations. Unclaimed property laws, as may be applicable, require us to report and to remit certain government authorities the property of others held by us that has been unclaimed for a specified period of time. We have policies and procedures designed to help us comply with these laws.

Intellectual Property

The protection of our intellectual property and all corresponding rights throughout the world, including our trademarks, service marks, trade dress, logos, trade names, domain names, goodwill, patents, copyrights, works of authorship (whether or not copyrightable), software and trade secrets, know-how, and proprietary and other confidential information, together with all applications, registrations, renewals, extensions, improvements and counterparts in connection with any of the foregoing, is important to the success of our business. We seek to protect our intellectual property rights by filing applications in various patent, trademark and other government offices, and relying on applicable laws and regulations in the U.S. and internationally, as well as a variety of administrative procedures. We have sought to register our core brands as domain names and as trademarks and service marks in the U.S. and a large number of other jurisdictions. We also have in place an active program to continue to secure, police and enforce trademarks, service marks, trade dress, logos, trade names, and domain names that correspond to our brands in markets of interest. We have filed patent applications in the U.S. covering certain aspects of our proprietary technology and new innovations. We also rely on contractual restrictions to protect our proprietary rights where appropriate when offering or procuring products and services. We have routinely entered into confidentiality and invention disclosure and assignment agreements with our

-29- employees and contractors, and non-disclosure agreements with external parties with whom we conduct business to control access to, and use and disclosure of, our proprietary information.

Human Capital

Our employees are essential in propelling our success. We hold our employees to high standards, both in work product and ethics, and aim to create a culture of accountability and results. Our performance expectations and attributes empower our company. They reflect how we expect employees to operate, collaborate and make decisions. At Bakkt, we strive to challenge the status quo with new ideas, have open and honest communications, appreciate our diversity of thought, take ownership and accountability for delivering valuable results and act with integrity, respect and reliability.

In a complex industry, it is critical for employees to act ethically. We provide regular training to help our employees understand and comply with the many regulations in our industry and with our company policies. We expect managers to set the tone for their teams and to lead by example, including by embracing ethical behavior and sharing its importance with their team. Managers are expected to help their teams understand our company policies and encourage them to report any violations of policy or law. As a company, we help ensure Bakkt’s non-retaliation policy is strictly followed.

At Bakkt, we understand that our success is built by operating as a unified company – one culture and team across the crypto landscape, with a focus on growth and innovation. We are committed to diversity throughout our company. It is our policy that employees are treated, and treat each other, with fairness, respect and dignity. We embrace our employees’ differences, while valuing a diverse, inclusive and safe workplace. We aim to promote diversity and inclusion through a number of employee engagement events including internal and external speaker sessions to foster learning on relevant and important topics. Our employees come from a wide variety of backgrounds to work toward a common vision for the Company. Our CEO brings our teams together in bi-weekly all hands calls and sends weekly email updates for transparency regarding our company strategy and goals.

We strive to hold employees accountable for their work performance while providing incentives for excellence in their contributions to the Company. We encourage open collaboration to put out the best ideas and solutions to better adapt to changing markets and other challenges Bakkt faces.

As of December 31, 2024, we had a total of 559 employees, all of whom were full-time employees, and are located in the United States. We also engage temporary employees, consultants and employers of record as needed to support our operations. Collectively, approximately 15% of our workforce is dedicated to engineering, design, or product roles. Our core locations are Alpharetta, GA, Scottsdale, AZ and New York City, NY. None of our employees are represented by a labor union or covered by a collective bargaining agreement. We have not experienced any work stoppages, and we consider our relations with our employees to be good.

Available Information

Our website is http://www.bakkt.com, and our investor relations website is located at https://investors.bakkt.com, where we make available, free of charge, our Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of

-30-

1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

We use our investor relations website to post important information for investors, including news releases, analyst presentations, and supplemental financial information, and as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. We use these channels as well as social media to communicate with the public about our company. It is possible that the information we post on social media could be deemed to be material information. Accordingly, investors should monitor our investor relations website as well as the social media channels listed on our investor relations website. The information on our website or any other website is not incorporated by reference into this Form 10-K.

-31-