Bakkt, Inc.

Each of our products is architected, deployed, and managed through a common controls environment designed to protect our customers' confidential information using a combination of administrative, physical, and technical controls. We maintain a comprehensive cyber security program, managed by a dedicated team of security professionals, leveraging multiple layers of defenses to protect our clients’ consumer data, as well as digital asset wallets, including digital assets that are kept in custody. Our administrative, technical, and physical controls include the use of separation of duties, physical and logical access controls, encryption, dedicated security monitoring, and other controls to protect our environment and restrict unauthorized access. Additionally, we regularly utilize independent external parties to assess and provide added assurance that our products are designed appropriately and operating effectively. We currently maintain independent SSAE-18 SOC 1 Type II and SOC 2 Type II attestation reports for our digital asset platform. We comply with NYDFS Part 500 cybersecurity requirements which impose requirements related to establishing a detailed cybersecurity plan, enacting a comprehensive cybersecurity policy, and maintaining an ongoing reporting system for cybersecurity events.

-25-

Regulation

International, federal and state laws and regulations apply to many key aspects of our business. Any actual or perceived failure to comply with these requirements may result in, among other things, the revocation, suspension, or conditioning of required licenses or registrations, the loss of approved status, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, private litigation, reputational harm, or constraints on our ability to continue to operate. We operate in a regulatory environment that is rapidly evolving and increasing in scope. Legislative and regulatory authorities at the federal and state level have taken, and may continue to take, actions to modify existing laws or adopt new laws or regulations related to digital assets and related activities. Current or future laws or regulations could be enacted, interpreted or applied in a manner that would materially support, prohibit, alter, or impair our existing or planned products and services, or that could require costly, time-consuming, or otherwise burdensome compliance measures, or could force us to modify our business in a manner to successfully compete with new or existing entrants in the industry. Further, additional laws and regulations may apply to our businesses as we expand outside of the United States or into new jurisdictions in the future. For more information, please see our risk factors described in“Item 1A. Risk Factors Risks Related to Crypto and Risks Related to Regulation, Taxation and Laws”.

Regulation of Our Money Transmission Business. BFS maintains money transmitter licenses in each U.S. jurisdiction in which such licenses are required for its activities and operates pursuant to applicable statutory and regulatory frameworks in jurisdictions where a money transmitter license is not presently required for the digital asset activities it conducts. BFS also is registered as a money services business” with the Financial Crimes Enforcement Network of the U.S. Department of the Treasury (“FinCEN”).

These licenses and registrations subject BFS to extensive regulatory oversight including record-keeping and reporting obligations, bonding and minimum capital requirements, limitations on the investment and safeguarding of customer funds, and periodic examinations by state and federal regulatory agencies. Applicable licensing regimes also impose requirements relating to changes of control, and the regulatory review or approval of controlling shareholders, directors, and senior management. Regulatory requirements may change over time, and BFS may be required to obtain additional licenses or approvals in the future.

Regulation of Our Virtual Currency Business. We are subject in certain jurisdictions to licensing and regulatory requirements as a result of offering clients the ability to aggregate, buy, sell, convert, and send virtual currency through our platform. Consequently, we are required to comply with applicable federal and state laws, rules, regulations, and supervisory guidance governing such activities, including requirements related to capitalization, consumer protection, anti-money laundering, disclosure, reporting and regulatory supervision and examination.

BFS holds a virtual currency license (“BitLicense”) issued by the New York Department of Financial Services (“NYDFS”), which subjects BFS to NYDFS oversight with respect to virtual currency business activities conducted in New York State and with New York residents. BFS also holds a Louisiana virtual currency business activity license, which subjects BFS to oversight by the Louisiana Office of Financial Institutions with respect to its virtual currency business activity conducted in Louisiana and with Louisiana residents.

In October 2023, the Governor of California signed into law the Digital Financial Assets Law (“DFAL”), which establishes a licensing framework administered by the California Department of Financial Protection and Innovation (“DFPI”) for entities engaged in digital financial asset business activity in California. Based on our current understanding of the DFAL, we expect that certain of our business activities may require licensure under the DFAL and intend to seek the applicable licenses or approvals prior to the DFAL’s effective date of July 1, 2026. The DFAL provides that the DFPI may issue a conditional license to entities that maintain a BitLicense or hold charter as a New York limited purpose trust company with approval to conduct virtual currency business under New York law. We continue to monitor guidance, rulemaking, and interpretive statements issued by the DFPI regarding the scope and application of the DFAL.

-26-

The laws and regulatory framework applicable to digital assets and related services remain subject to interpretation and change. For instance, the SEC has indicated in various enforcement actions and other public statements that certain digital assets may constitute securities under U.S. federal securities laws. Although certain enforcement actions have reportedly been closed without further action,the SEC has not adopted comprehensive rules specifically addressing the regulatory classification of digital assets. Although the SEC has yet to issue guidance, it has put forth analytical frameworks and relevant factors to consider in this analysis, and has recently established a Crypto Task Force, which may reflect evolving regulatory priorities or increased regulatory focus in the area. As a result, our digital asset-related services offered through our platform may become subject to additional registration requirements, regulatory scrutiny, enforcement actions, or other regulatory developments, which could require us to modify, suspend, or discontinue certain products or services or incur additional compliance costs. .

Privacy and Information Cybersecurity Regulations. Aspects of our operations or business are subject to laws and regulation in the United States and in foreign jurisdictions relating to privacy, data protection and cybersecurity. Accordingly, we publish our privacy policies and terms of service, which describe our practices concerning the use, protection, transmission, and disclosure of information. As our business continues to expand in the United States and beyond, and as laws and regulations continue to be passed and their interpretations continue to evolve in numerous jurisdictions, additional laws and regulations may become relevant to us.

Regulatory authorities around the world are considering numerous legislative and regulatory proposals concerning privacy, data protection and cybersecurity. In addition, the interpretation and application of these laws and regulations in the United States and elsewhere are often uncertain and in a state of flux. As our business continues to develop and expand, we continue to monitor the additional rules and regulations that may become relevant. For additional information regarding these laws and regulations and related risks, please see “Risk Factors Risks Related to Regulation, Taxation, and Laws Complying with evolving privacyand other data related laws and requirements may be expensive and force us to make changes to our business, and failure to comply with such laws and requirements could result in substantial harm to our business.”

Consumer Protection Regulation. The Consumer Financial Protection Bureau and other federal and state regulatory agencies, including the Federal Trade Commission, broadly regulate financial products, enforce consumer protection laws applicable to credit, deposit, prepaid products, and payments, and other similar products, and possess supervisory and enforcement authority with respect to such activities. Such agencies have broad consumer protection mandates, and they promulgate, interpret, and enforce laws, rules and regulations, including with respect to unfair, deceptive, or abusive acts or practices (“UDAAP”) and other consumer protection standards that may impact or apply to our business.

For example, under federal and state financial privacy laws and regulations, we must provide notice to consumers of our policies on sharing non-public information with third parties, among other requirements. In addition, under the Electronic Fund Transfer Act (“EFTA”) and its implementing regulations, we are required to disclose the terms of, and any fees applicable to, our electronic fund transfer services to consumers prior to their use of the service, and comply with applicable error resolution, consumer liability and related disclosure.

Anti-Money Laundering and Counter-Terrorism Regulation. We are subject to AML laws and regulations in the United States, including the BSA, as amended, and its implemented regulations enforced by FinCEN, as well as other federal and state laws designed to prevent the use of the financial systems to facilitate terrorist activities and other illicit conduct. We have implemented a comprehensive AML compliance program designed to prevent our platform from being used to facilitate money laundering, terrorist financing, and other illicit activity. Our program is also designed to prevent our platform from being used to facilitate business in countries, or with persons or entities, included on designated sanctions lists promulgated by OFAC and comparable foreign sanction authorities.

Our AML compliance program is comprised of policies, procedures, reporting protocols, and internal controls, including including reporting requirements for suspicious transactions, the designation of a compliance officer, employee

-27- training, and periodic independent testing and review of the program. It is designed to address applicable legal and regulatory requirements and to mitigate risk associated with money laundering, terrorist financing and sanctions violations. Failure to comply with applicable AML, sanctions, and counter-terrorist financing requirements may result in regulatory investigations, administrative enforcement actions, monetary penalties, civil or criminal liability, or other sanctions.

Indirect Regulatory Requirements. We maintain relationships with certain clients, including banks and other financial institutions in the United States, that are regulated by state, local and federal agencies. Because of these relationships, we may be subject to oversight by such institutions’ regulators, including examination to the extent such regulators exercise their authorities under applicable law. In addition, the federal banking agencies have issued supervisory guidance applicable to banks with respect to their relationships with third parties. This guidance may apply to us and our bank clients in connection with the overall relationship, including with respect to strategies and objectives, financial condition, risk management, information security and systems, operational resilience, audit rights, and performance standards. We generally seek to address these indirect regulatory requirements in our commercial agreements, as appropriate.

Escheatment and Unclaimed Property Regulations. There is regulatory uncertainty regarding how states and jurisdictions treat virtual currencies and other digital assets under unclaimed property laws and regulations. Unclaimed property laws, as may be applicable, require us to report and to remit certain government authorities the property of others held by us that has been unclaimed for a specified period of time. We have policies and procedures designed to help us comply with these laws.

Intellectual Property

The protection of our intellectual property and all corresponding rights throughout the world, including our trademarks, service marks, trade dress, logos, trade names, domain names, goodwill, patents, copyrights, works of authorship (whether or not copyrightable), software and trade secrets, know-how, and proprietary and other confidential information, together with all applications, registrations, renewals, extensions, improvements and counterparts in connection with any of the foregoing, is important to the success of our business. We seek to protect our intellectual property rights by filing applications in various patent, trademark and other government offices, and relying on applicable laws and regulations in the U.S. and internationally, as well as a variety of administrative procedures. We have sought to register our core brands as domain names and as trademarks and service marks in the U.S. and a large number of other jurisdictions. We also have in place an active program to continue to secure, police and enforce trademarks, service marks, trade dress, logos, trade names, and domain names that correspond to our brands in markets of interest. We have filed patent applications in the U.S. covering certain aspects of our proprietary technology and new innovations. We also rely on contractual restrictions to protect our proprietary rights where appropriate when offering or procuring products and services. We have routinely entered into confidentiality and invention disclosure and assignment agreements with our employees and contractors, and non-disclosure agreements with external parties with whom we conduct business to control access to, and use and disclosure of, our proprietary information.

Human Capital

We recognize that the future of digital financial infrastructure is not built solely on code, but on the specialized expertise and collaboration of our employees. We believe in cultivating an entrepreneurial culture, built on the pillars of transparency, ownership, and accountability. As of December 31, 2025, we had a total of 48 employees, all of whom were full-time employees located in the United States. We also engage contractors, consultants and professionals throughout the globe, as needed to support our operations.

Available Information

Our website is http://www.bakkt.com, and our investor relations website is located at https://investors.bakkt.com, where we make available, free of charge, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q and Current

-28-

Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

We use our investor relations website to post important information for investors, including news releases, analyst presentations, and supplemental financial information, and as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. We use these channels as well as social media to communicate with the public about our company. It is possible that the information we post on social media could be deemed to be material information. Accordingly, investors should monitor our investor relations website as well as the social media channels listed on our investor relations website. The information on our website or any other website is not incorporated by reference into this Form 10-K.

-29-