Wheels Up Experience Inc.

Risks Relating to Technology, Cybersecurity and Data Privacy

Any failure of or unauthorized access to our information security and data privacy systems may harm our reputation and adversely affect our business, results of operations and financial condition.

We devote significant resources to and place high importance on maintaining the security and integrity of the member, customer, employee and third-party information that we process. Instances of unauthorized access to information systems and data have been prevalent in recent years and resulted in significant disruption, losses and reputational harm for companies, including for other participants in the private aviation industry. We are subject to, among others, the following risks related to information security and data privacy, any one of which could adversely affect our business, increase costs for detection, assessment and remediation, result in legal claims or proceedings, liability or regulatory penalties against us related to unauthorized access, breaches or misappropriation or harm our brand and reputation, which in turn could adversely affect our business, results of operations, financial condition and reputation:

•a cybersecurity incident, breach or disruption involving our internal network or information systems, including as a result of ransomware or malware attacks, vulnerabilities in licensed software or hardware or the use of third-party networks that we do not control or have the ability to monitor due to a significant portion of our workforce working remotely from time to time or traveling frequently, or as a result of other attacks or misappropriation, including artificial intelligence (AI) related issues;

•the loss, disclosure, misappropriation of, misuse, or unauthorized access to members’, customers’, employees’, third-party operators’, vendors’ or other business partners’ information, including personal identifying information, due to a compromise of our systems or technology, or any inability to operate our systems; and

•our inability to anticipate or detect for extended periods of time a cybersecurity incident or breach, or unauthorized access to or use of data, including personal identifying information, sensitive competitive data or safety and security-related data about our members, customers, employees, vendors or operations, or confidential or other critical data or systems, and our reliance on third parties to help us to implement and manage our cybersecurity risks.

A failure in our technology or technology infrastructure, including due to our reliance on third parties, may adversely affect our business, results of operations and financial condition.

The performance and reliability of our information technology systems and business processes, including UP FMS, the Wheels Up mobile app and other systems we use to manage our operations and ensure a high quality experience for our members and customers are critical to our operations. Certain of these information technology systems are created, hosted or facilitated by or through third parties that we do not control or influence. We are subject to, among other things, the following risks related to our technology and systems, any one of which could adversely affect our business, results of operations, financial condition, brand and reputation:

•a disruption or change in service levels with respect to our mobile and web-based applications, UP FMS and cloud infrastructure services provided by third parties, and large-scale external interruption in the technological infrastructures on which we and our third-party operators depend, that are outside of our control and may be affected by, among others, natural disasters, cybersecurity attacks, human or software errors, website hosting disruptions, capacity constraints, terrorist attacks, power outages, epidemics and pandemics, an isolated, recurring or sustained internal technological error or failure, and similar events or acts of misconduct that could last for short or extended periods;

•faulty updates from third-party software providers that may interrupt other applications or lead to system outages that result in operational delays or require unexpected expenditures or expertise to remediate; and

•our failure to adequately invest in information systems and cybersecurity software, programs and personnel to effectively implement and manage our cybersecurity risks and cost constraints associated with any measures that we take and such third parties take to avoid, detect, mitigate or recover from material cybersecurity threats or incidents, and the possibility that such measures may be insufficient or ineffective depending on the circumstances.

Privacy concerns in the territories in which we operate could result in additional costs and liabilities to us.

Many government bodies and agencies have adopted or are considering adopting laws and regulations regarding the processing and protection of personal information, breach notification procedures and other data privacy protocols. We are required to comply with certain laws, rules and regulations relating to data security in the areas in which we operate. Interpretation of these laws, rules and regulations and their application to our software, offerings and services in applicable jurisdictions is ongoing and evolves constantly.

In the U.S., rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, and other current or future state and federal laws relating to privacy and data security could increase our exposure to regulatory enforcement action, increase our compliance costs and adversely affect our business. Certain laws require disclosures about the use of personal data, require users to be able to opt out of information sharing, create causes of actions for data breaches and/or include enforcement and penalty regimes. In addition, the SEC requires disclosures of any cybersecurity or data privacy breaches promptly after their discovery. There is some uncertainty as to how emerging federal and state privacy laws could impact our business as it depends on how such laws will be interpreted.

Outside the U.S., an increasing number of laws, regulations and industry standards apply to data privacy and security, such as the GDPR in the EU, the U.K. DPA and other regulations could increase our exposure to regulatory enforcement action, increase our compliance costs and adversely affect our business. These regulations increased covered businesses’ data privacy and security obligations and imposed stringent data privacy and security requirements, including, for example, detailed notices about how such businesses process personal data, the implementation of security measures, mandatory security breach notification requirements, contractual data protection requirements and limitations on records retention for personal data processing activities.

We expect to continue to devote increasing time and resources to complying with emerging data privacy and cybersecurity laws, rules and regulations. Any failure to comply with applicable data security laws, regulations and rules to which we are subject to could result in, among other things, regulatory proceedings or disputes or litigation against us, losses, damages and fines, or adverse impacts to our business, results of operations and financial condition.

Risks Relating to Ownership of Our Securities and Being a Public Company

Certain stockholders, which are also lenders to the Company, have significant influence over the Company.

As of the date of this Annual Report, Delta, CK Wheels and CIH collectively own a substantial majority of the outstanding Common Stock. Such stockholders have sufficient voting power to significantly influence all matters requiring stockholder approval, whether at a meeting of stockholders or by written consent as permitted under our Certificate of Incorporation, including the election of directors (including the right to designate nine of the twelve directors on our Board), changes to our Board and management and approval of strategic corporate transactions. Additionally, such stockholders, in their capacity as Lenders under the Credit Agreement, must consent to certain transactions and can direct the agent under the Credit Agreement to exercise or refrain from exercising remedies in the event of a default. As a result, such stockholders in their capacity as stockholders and lenders, may exhibit significant influence over the Company, including for commercial and strategic transactions and other business initiatives involving such stockholders. The interests or objectives of these stockholders may differ from the interests or objectives of the Company and/or other stockholders.

In addition, sales by our largest stockholders of our Common Stock in the public market or the perception in the market that they intend to sell shares could increase the volatility of our Common Stock price or result in a sustained market price decrease. The perception or expectation among the public regarding any such sales or the ability of such stockholders to maintain certain rights tied to the level of ownership of Common Stock could also contribute to a decline in the market price of our Common Stock. Similarly, if these stockholders assign or transfer their rights and obligations under the Term Loan or Revolving Credit Facility to third parties, the third parties could exercise, among other things, certain consent and voting rights pursuant to the terms of the Credit Agreement, which could have an adverse effect on our business, results of operations and financial condition.

The price of our Common Stock may be volatile, including due to dilutive issuances of Common Stock or securities convertible into or exchangeable or exercisable for Common Stock.

An investment in our Common Stock involves risk and the price of our Common Stock may fluctuate due to factors within and outside of our control, including the risk factors and discussions described in this Annual Report or our future filings with the SEC. In addition, we have completed, and may in the future complete, dilutive issuances of Common Stock, other equity securities or securities convertible into or exchangeable or exercisable for Common Stock, including pursuant to our current at-the-market Common Stock offering program. The issuance of additional Common Stock, other equity securities or securities convertible into or exchangeable or exercisable for Common Stock, whether pursuant to public offerings or at-the-market equity distribution programs, private placements, equity incentive plans, existing instruments or otherwise, may result in additional dilution to existing holders of Common Stock and adversely affect the market price and volatility of our Common Stock. In addition, certain of our Lenders hold enough shares of Common Stock as of the date of this Annual Report to provide the required stockholder approval for equity incentive plans under which we grant equity awards settleable into Common Stock to certain directors, executive officers and employees. Any of the foregoing that increase the number of outstanding shares of Common Stock will decrease the percentage ownership held by our existing stockholders and their relative voting power. Also, any future dilutive issuance could be the subject of stockholder litigation or disputes, which could adversely affect our business, results of operations and financial condition.

The NYSE may delist our Common Stock from trading on its exchange, which could limit investors’ ability to transact in our securities and subject us to additional trading restrictions.

On December 17, 2025, we received a notice from the NYSE that we are no longer in compliance with Section 802.01C of the NYSE Listed Company Manual (“Section 802.01C”), which requires listed companies to maintain an average closing price per share of at least $1.00 over a consecutive 30 trading-day period. We have until June 17, 2026 to regain compliance with Section 802.01C. There can be no assurance that we will regain compliance with Section 802.01C or that we will meet the NYSE’s continued listing standards in the future to maintain the listing of our Common Stock on the NYSE, which could be impacted by, among others, the trading price of our Common Stock, our results of operations in future periods, other events involving us and general economic, market and industry conditions. The delisting of our Common Stock from the NYSE or actions we may take to list on an another securities exchange, could impact the trading prices, liquidity and volatility of our Common Stock, affect our ability to obtain new financing or refinance our existing obligations and/or result in a loss of confidence by our members, customers, business partners, stockholders or employees, each of which could adversely affect our business, results of operations and financial condition.

Any material weakness in internal control over financial reporting (“ICFR”) or failure to maintain effective disclosure controls and procedures (“DCP”) could result in material misstatements of our financial statements or cause us to fail to meet our reporting obligations.

SEC rules define a material weakness as a deficiency, or a combination of control deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of a registrant’s financial statements will not be prevented or detected on a timely basis. We must annually provide management’s attestation on internal controls pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 (“SOX”). We must also disclose significant changes to our internal controls procedures on a quarterly basis and any material weaknesses identified by our management in our ICFR during related assessments. In addition, our independent registered public accounting firm must attest annually to the effectiveness of our ICFR under SOX.

In past periods, we identified material weaknesses in our ICFR and determined that our DCP were not effective during such periods. We can provide no assurance that measures to remediate deficiencies in past periods or other measures intended to strengthen our internal controls from time-to-time will be sufficient to remediate those control deficiencies or new deficiencies, or that such measures will prevent or avoid any potential future deficiencies in our internal controls. Any deficiencies identified in our ICFR or DCP, if not timely detected and remediated, could limit our ability to prevent or detect a misstatement of our accounts or disclosures that could result in a material weakness or material misstatement of our annual or interim financial statements, or the failure to timely file required reports under the Exchange Act. If any of these instances were to occur, it could cause our stockholders, investors, members and customers to lose confidence in the accuracy and completeness of our financial reports, result in a decline in the trading prices for our Common Stock and harm our capital raising efforts. Each of the foregoing items could adversely affect our business, results of operations, financial condition and the market price and volatility of our Common Stock.

We are currently subject to litigation related to a past restatement of our financial statements, and face the potential for additional litigation or other disputes or sanctions or investigations by the SEC, NYSE or other regulatory authorities, related to internal controls, control deficiencies or financial misstatements in the future, which could have an adverse effect on our business, results of operations and financial condition.

Risks Relating to Our Organizational Documents

Delaware law and our Organizational Documents contain provisions that limit the ability of stockholders to take certain actions and could delay or discourage takeover attempts that stockholders may consider favorable.

Our Certificate of Incorporation and Amended and Restated By-Laws, effective November 15, 2023 (our “By-Laws” and, together with the Certificate of Incorporation, our “Organizational Documents”) and the Delaware General Corporation Law (the “DGCL”) contain provisions that could make more difficult, delay or prevent an acquisition that stockholders may consider favorable or in which they might otherwise receive a premium for their shares or limit the price that investors might be willing to pay for our Common Stock and reduce the trading price of our Common Stock. These provisions could also make it difficult for stockholders to take certain actions, including electing directors who are not nominated by the current members of our Board or other corporate actions. Our Organizational Documents include provisions:

•providing for a classified board of directors with staggered, three-year terms and prohibiting cumulative voting in director elections, which limits the ability of minority stockholders to elect director candidates;

•giving our Board the right to issue and determine the price, preferences, voting rights and other features of shares of preferred stock, including “blank check” preferred stock, without stockholder approval, which could be used to dilute the ownership of a hostile acquirer;

•permitting the holders of outstanding shares of the relevant class or series having not less than the minimum number of votes that would be necessary to authorize or take such action at a meeting of stockholders to act by written consent without a meeting;

•giving our Board the right to amend our By-Laws, which may allow our Board to prevent an unsolicited takeover and frustrate an acquirer’s attempt to amend our By-Laws to facilitate an unsolicited takeover; and

•requiring stockholders to comply with advanced notice procedures to nominate director candidates or submit stockholder voting proposals, which could discourage stockholders from proposing matters for meetings of stockholders, delay changes in our Board, or discourage or deter a potential acquirer from conducting a proxy solicitation to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us.

In addition, the terms of the Investor Rights Agreement may have the effect of delaying or preventing hostile takeovers, changes in control or changes in our Board or management if the parties thereto then own a substantial amount of Common Stock and do not participate or consent to the applicable transaction. These provisions, alone or together, could delay or prevent hostile takeovers, changes in control or changes in our Board or management.

Our Certificate of Incorporation has an exclusive forum provision for certain lawsuits that may have the effect of discouraging certain lawsuits, including derivative lawsuits and lawsuits against our directors and officers, by limiting plaintiffs’ ability to bring a claim in a judicial forum that they find favorable.

Our Certificate of Incorporation provides that, to the fullest extent permitted by law, and unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware (or, if that such court does not have jurisdiction, the federal district court for the District of Delaware or other state courts of the State of Delaware) will be the sole and exclusive forum for any claims made by any stockholder (including a beneficial owner) for any (i) derivative action or proceeding brought on our behalf, (ii) action asserting a claim of breach of a fiduciary duty owed by any director, officer or other employee to us or our stockholders, (iii) action asserting a claim against us, our directors, officers or employees arising pursuant to any provision of the DGCL or our Organizational Documents, (iv) action asserting a claim against us, our directors, officers or employees governed by the internal affairs doctrine or (v) action asserting an “internal corporate claim” (as that term is defined in Section 115 of the DGCL). Our Certificate of Incorporation provides that federal district courts will be the sole and exclusive forum for claims under the Securities Act and Exchange Act. These provisions may discourage certain lawsuits, including derivative lawsuits and lawsuits against our directors and officers, by limiting plaintiffs’ ability to bring a claim in certain judicial forums, subject to the possibility that a court could find the choice of forum provisions contained in our Certificate of Incorporation to be inapplicable or unenforceable in such action.

Our Organizational Documents and the Investor Rights Agreement include provisions limiting voting and control by non-U.S. Citizens.

To comply with restrictions imposed by federal law on foreign ownership of U.S. air carriers, our Organizational Documents restrict voting of capital stock held by non-U.S. Citizens. Under federal law, no more than 25% of our stock can be voted, directly or indirectly, by persons who are not U.S. Citizens, and our president/chief executive officer, at least two-thirds of our officers and at least two-thirds of the members of our Board must be U.S. Citizens. Our By-Laws provide that if the number of shares of our capital stock owned or controlled by non-U.S. Citizens exceed 25% of the voting power of our capital stock, the voting rights of the capital stock owned or controlled by non-U.S. Citizens and not registered on a separate stock record (the “Foreign Stock Record”) at the time of any vote or action will be suspended. Voting power will be reinstated for such shares not registered on the Foreign Stock Record upon the earlier of (i) transfer to a U.S. Citizen and (ii) registration of the shares on the Foreign Stock Record. The Investor Rights Agreement also limits the number of shares of Common Stock held by certain Lenders that may be voted by such stockholders in a manner intended to comply with the foregoing requirements. This limitation is also referred to herein as the “Citizenship Limitation.”

The number of shares entered on the Foreign Stock Record may not exceed the Citizenship Limitation and if it does, the voting rights of each stockholder with capital stock registered on the Foreign Stock Record will be suspended on a pro rata basis such that the voting rights afforded to the stock registered on the Foreign Stock Record is equal to the Citizenship Limitation. Voting rights will be reinstated once the voting rights of the capital stock registered on the Foreign Stock Record ceases to exceed the Citizenship Limitation, not taking into consideration the pro rata reduction. Our transfer agent maintains the Foreign Stock Record, but each stockholder that is not a U.S. Citizen is required to register their shares of capital stock as a non-U.S. Citizen.