Robinhood Markets Inc

Previous wording

•Any particular cryptocurrency’s status as a “security” is subject to a high degree of uncertainty and if we have not properly characterized one or more cryptocurrencies, we might be subject to regulatory scrutiny, investigations, fines, and other penalties.

Current wording

•In the United States, any particular cryptocurrency’s status as a “security” is subject to a high degree of uncertainty and if we have not properly characterized one or more cryptocurrencies, we might be subject to regulatory scrutiny, investigations, fines, and other penalties.

Previous wording

A large portion of our revenue is transaction-based, in that we receive consideration in exchange for routing our users’ equity, option, and cryptocurrency trade orders to market makers for execution. With respect to equities and options trading, such fees are known as payment for order flow, or “PFOF.” With respect to cryptocurrency trading, we receive “Transaction Rebates.” Our transaction-based revenue is sensitive to and dependent on trading volumes and therefore tends to decline during periods in which we experience decreased levels of trading generally. Computer-generated buy/sell programs and other technological advances and regulatory changes in the marketplace might continue to tighten spreads on transactions, which could also lead to a decrease in our PFOF earned from market makers. In addition, the regulatory landscape involving cryptocurrencies is subject to change and is experiencing rapid evolution, and future regulatory actions or policies, including for instance, the assertion of jurisdiction by domestic and foreign regulators and governments over cryptocurrency and cryptocurrency markets, could reduce demand for cryptocurrency trading and might materially decrease our revenue derived from Transaction Rebates in absolute terms and as a proportion of our total revenues. In addition, to the extent that the SEC or a court asserts or determines that any cryptocurrencies supported by our RHC platform are securities, we might not continue to facilitate trading of those cryptocurrencies in the U.S. (including ceasing support for such cryptocurrencies on our RHC platform) or it might cause us to proactively remove certain cryptocurrencies from our RHC platform because they share similarities with such cryptocurrencies.

Current wording

A large portion of our revenue is transaction-based, in that we receive consideration in exchange for routing our users’ equity, option, and cryptocurrency trade orders to market makers for execution. With respect to equities and options trading, such fees are known as payment for order flow, or “PFOF.” With respect to cryptocurrency trading, we receive “Transaction Rebates.” Our transaction-based revenue is sensitive to and dependent on trading volumes and therefore tends to decline during periods in which we experience decreased levels of trading generally. Computer-generated buy/sell programs and other technological advances and regulatory changes in the marketplace might continue to tighten spreads on transactions, which could also lead to a decrease in our PFOF earned from market makers. In addition, the regulatory landscape involving cryptocurrencies is subject to change and is experiencing rapid evolution, and future regulatory actions or policies, including for instance, the assertion of jurisdiction by domestic and foreign regulators and governments over cryptocurrency and cryptocurrency markets, could reduce demand for cryptocurrency trading and might materially decrease our revenue derived from Transaction Rebates in absolute terms and as a proportion of our total revenues. In addition, to the extent that the SEC or a court asserts or determines that any cryptocurrencies supported by our RHC platform are securities, we might not continue to facilitate trading of those cryptocurrencies in the U.S. (including ceasing support for such cryptocurrencies on our RHC platform, for instance, with respect to Cardano, Polygon, and Solana) or it might cause us to proactively remove certain cryptocurrencies from our RHC platform because they share similarities with such cryptocurrencies.

Previous wording

Additionally, disruptions in the services provided by our market makers, whether due to technical malfunctions, operational mishaps, or financial instability of the market makers, or external factors such as regulatory changes or market volatility, have in the past, and may in the future impair our ability to execute our client's orders. Should a designated market maker venue experience downtime or diminished performance, particularly during peak trading hours, our ability to execute customer orders could be compromised and could have an adverse impact on our business, financial condition and results of operations.

Current wording

Additionally, disruptions in the services provided by our market makers, whether due to technical malfunctions, operational mishaps, or financial instability of the market makers, or external factors such as regulatory changes or market volatility, have in the past, and may in the future impair our ability to execute our client's orders. Should a market maker venue experience downtime or diminished performance, particularly during peak trading hours, our ability to execute customer orders could be compromised and could have an adverse impact on our business, financial condition and results of operations.

Previous wording

As registered broker-dealers, we are subject to “best execution” requirements under SEC guidelines and FINRA rules, which requires us to obtain the best reasonably available terms for customer orders. As previously disclosed, in December 2019 and 2020, we settled a FINRA disciplinary action and an SEC investigation, respectively, that related to our best execution practices. We face a risk of additional investigations or penalties in the future related to our best execution practices.

Current wording

As registered broker-dealers, we are subject to “best execution” requirements under SEC guidelines and FINRA rules, which requires us to obtain the best reasonably available terms for customer orders. We have in the past and continue to be subject to investigations related to our best execution practices. For example, as previously disclosed, in December 2019 and 2020, we settled a FINRA disciplinary action and an SEC investigation, respectively, that related to our best execution practices. We face a risk of additional investigations or penalties in the future related to our best execution practices.

Previous wording

In addition, our clearing and carrying broker-dealer is subject to cash deposit and collateral requirements under the rules of the clearinghouses in which it participates (including DTC, NSCC, and OCC), which requirements fluctuate significantly from time to time based upon the nature and volume of customers’ trading activity and volatility in the market or individual securities. If we fail to meet any such deposit requirements, our ability to settle trades through the clearinghouse may be suspended or we might be forced to restrict trading in certain stocks in order to limit clearinghouse deposit requirements. For example, from January 28 to February 5, 2021, due to increased deposit requirements imposed on our clearing and carrying broker-dealer by NSCC in response to unprecedented market volatility, particularly in certain securities, we implemented the Early 2021 Trading Restrictions. This resulted in negative media attention, customer dissatisfaction, reputational harm, litigation, and regulatory and U.S. Congressional inquiries and investigations, as well as capital raising by us in order to lift the trading restrictions while remaining in compliance with our net capital and deposit requirements. We face a risk that similar events could occur in the future and, if we are unable to satisfy our deposit requirements, the clearinghouse may cease to act for us and may liquidate our unsettled clearing portfolio.

Current wording

For example, from January 28 to February 5, 2021, due to increased deposit requirements imposed on our clearing and carrying broker-dealer by NSCC in response to unprecedented market volatility, particularly in certain securities, we implemented the Early 2021 Trading Restrictions. This resulted in negative media attention, customer dissatisfaction, reputational harm, litigation, and regulatory and U.S. Congressional inquiries and investigations, as well as capital raising by us in order to lift the trading restrictions while remaining in compliance with our net capital and deposit requirements. We face a risk that similar events could occur in the future and, if we are unable to satisfy our deposit requirements, the clearinghouse may cease to act for us and may liquidate our unsettled clearing portfolio.

Previous wording

We maintain cash and investment accounts, as well as restricted cash as certificates of deposits for facility leases and other contractual obligations, at multiple financial institutions in amounts that are significantly in excess of the limits insured by the U.S. Federal Deposit Insurance Corporation (“FDIC”). In spring 2023, certain U.S. banks failed and were taken over by the FDIC (the “2023 Banking Events”). If any of the financial institutions where we hold significant deposits were to fail or be taken over by the FDIC, our ability to access such accounts has in the past and could be in the future temporarily or permanently limited, which could adversely affect our business. In particular, while we have taken steps to help ensure that the loss of all or a significant portion of any uninsured amount would not have an adverse effect on our ability to pay our operational expenses or make other payments, the failure of a financial institution where we hold significant deposits has in the past and may in the future require us to move funds to another bank, which could cause a temporary delay in making payments to our vendors and employees, or under other contractual arrangements, and cause other operational inconveniences. Additionally, any losses or delay in access to funds as a result of such events could have a material adverse effect on our ability to meet contractual obligations, earnings, financial condition, cash flows, and stock price.

Current wording

We maintain cash and investment accounts, as well as restricted cash as certificates of deposits for facility leases and other contractual obligations, at multiple financial institutions in amounts that are significantly in excess of the limits insured by the FDIC. In spring 2023, certain U.S. banks failed and were taken over by the FDIC (the “2023 Banking Events”). If any of the financial institutions where we hold significant deposits were to fail or be taken over by the FDIC, our ability to access such accounts has in the past and could be in the future temporarily or permanently limited, which could adversely affect our business. In particular, while we have taken steps to help ensure that the loss of all or a significant portion of any uninsured amount would not have an adverse effect on our ability to pay our operational expenses or make other payments, the failure of a financial institution where we hold significant deposits has in the past and may in the future require us to move funds to another bank, which could cause a temporary delay in making payments to our vendors and employees, or under other contractual arrangements, and cause other operational inconveniences. Additionally, any losses or delay in access to funds as a result of such events could have a material adverse effect on our ability to meet contractual obligations, earnings, financial condition, cash flows, and stock price.

Previous wording

We also might not be successful in attracting, integrating or retaining qualified personnel to fulfill our current or future needs. In particular, there continues to be particularly high competition in the San Francisco Bay Area for software engineers, computer scientists and other technical personnel. Given our heavy emphasis on SBC, the performance of our stock price has in the past had, and could continue to have a significant impact on our ability to recruit, retain, and motivate highly skilled personnel. Additionally, the Return to Office policy may negatively impact our ability to retain and recruit highly skilled personnel, especially to the extent other companies continue to allow more flexible remote working models. Attrition and workforce reorganizations and reductions have also and might continue to adversely affect our reputation among job seekers, demoralize our remaining employees, and result in a loss of institutional know-how, reduced productivity, slower customer service response, reduced effectiveness of internal compliance and risk-mitigation programs, and cancellations of or delays in completing new product developments and other strategic projects. For example, in the periods immediately following the April 2022 Restructuring and August 2022 Restructuring, we experienced higher rates of voluntary employee attrition and declines in reported employee job satisfaction. We might continue to experience difficulty in hiring and retaining highly skilled employees with appropriate qualifications.

Current wording

We also might not be successful in attracting, integrating or retaining qualified personnel to fulfill our current or future needs. In particular, there continues to be particularly high competition in the San Francisco Bay Area for software engineers, computer scientists and other technical personnel. Given our heavy emphasis on SBC, the performance of our stock price has in the past had, and could continue to have a significant impact on our ability to recruit, retain, and motivate highly skilled personnel. Additionally, our working model may negatively impact our ability to retain and recruit highly skilled personnel, especially to the extent other companies continue to allow more flexible remote working models. Attrition and workforce reorganizations and reductions have also and might continue to adversely affect our reputation among job seekers, demoralize our remaining employees, and result in a loss of institutional know-how, reduced productivity, slower customer service response, reduced effectiveness of internal compliance and risk-mitigation programs, and cancellations of or delays in completing new product developments and other strategic projects. For example, in the periods immediately following the April 2022 Restructuring and August 2022 Restructuring, we experienced higher rates of voluntary employee attrition and declines in reported employee job satisfaction. We might continue to experience difficulty in hiring and retaining highly skilled employees with appropriate qualifications.

Previous wording

For example, in April 2022 we signed a definitive agreement to acquire Ziglu Limited (“Ziglu”), a U.K.-based electronic money institution and crypto asset firm. However, as a result of prolonged regulatory uncertainty, after careful consideration, we notified Ziglu of the termination of the agreement in February 2023. In connection with the termination of the agreement, we took a $12 million impairment charge, in addition to suffering losses from legal fees and other expenses. Additionally, because we had expected Ziglu’s team and technology to help accelerate our international expansion, the termination of the deal delayed our initial plans to expand our operations in Europe, particularly with respect to cryptocurrency trading.

Current wording

For example, in April 2022 we signed a definitive agreement to acquire Ziglu Limited (“Ziglu”), a U.K.-based electronic money institution and crypto asset firm. However, as a result of prolonged regulatory uncertainty, after careful consideration, we notified Ziglu of the termination of the agreement in February 2023. In connection with the termination of the agreement, we took a $12 million impairment charge, in addition to suffering losses from legal fees and other expenses. Additionally, because we had expected Ziglu’s team and technology to help accelerate our international expansion, the termination of the deal delayed our initial plans to expand our operations in Europe, particularly with respect to cryptocurrency trading. Furthermore, in June 2024, we entered into an agreement to acquire Bitstamp, a global cryptocurrency exchange with retail and institutional investors, subject to regulatory approvals and other customary closing conditions. We expect Bitstamp and its team will help us accelerate our international expansion with respect to cryptocurrency trading, however, our ability to close this transaction is subject to customary closing conditions, including regulatory approvals, and if we are unable to complete this transaction, we could be subject to losses from legal fees and other expenses.

Previous wording

We currently only offer select services to the public outside the United States in certain jurisdictions, including brokerage services in the UK through Robinhood UK, Ltd., crypto services in select jurisdictions in the EU through Robinhood Europe, UAB (“RHEC”), and our Robinhood Wallet, which is available in over 150 countries and offered through our Cayman Islands subsidiary, Robinhood Non-Custodial Ltd.

Current wording

We currently only offer select services to the public outside the United States in certain jurisdictions, including brokerage services in the UK through Robinhood UK, Ltd., crypto services in select jurisdictions in the EU through RHEC, and our Robinhood Wallet, which is available in over 150 countries and offered through our Cayman Islands subsidiary, Robinhood Non-Custodial Ltd. We also expect that our pending acquisition of Bitstamp, if completed, will help us accelerate our international expansion, including across the EU, in the U.K. and in certain other countries.

Previous wording

We currently have a remote work policy, under which a large segment of our employees are not required to come into the office on a daily basis, although since September 2023, most employees living within 35 miles of any of our offices are expected to work in-office at least three days a week (the “Return to Office policy”). Employees who do not live within 35 miles of any of our offices continue to be allowed to work remotely full-time. Allowing our employees to work remotely subjects us to heightened operational risks. For example, technologies in our employees’ homes might not be as robust or effective as in our offices and could lead to lower productivity and/or increased vulnerability to cybersecurity attacks or other privacy or data security incidents. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees accessing company data and systems remotely. Additionally, in January 2024 FINRA adopted a new rule (the “Residential Supervisory Location Designation Rule”) that will become effective in June 2024. Under the Residential Supervisory Location Designation Rule, the homes of certain of our employees who work remotely could be treated as “residential supervisory locations” subject to inspections on a regular periodic schedule, which in turn could require certain operational changes and compliance adjustments. Non-compliance with the Residential Supervisory Location Designation Rule could subject us to fines, penalties or enforcement actions. We also face challenges due to the need to operate with a dispersed and remote workforce, as well as increased costs related to business continuity initiatives.

Current wording

We currently have a large segment of employees who work remotely and are not required to come into the office on a daily basis. Allowing employees to work remotely subjects us to heightened operational risks. For example, technologies in our employees’ homes might not be as robust or effective as in our offices and could lead to lower productivity and/or increased vulnerability to cybersecurity attacks or other privacy or data security incidents. There is no guarantee that the data security and privacy safeguards we have put in place will be completely effective or that we will not encounter risks associated with employees accessing company data and systems remotely. Additionally, in June 2024 FINRA’s new Residential Supervisory Location Designation Rule became effective, under which the homes of certain of our employees who work remotely could be treated as “residential supervisory locations” subject to inspections on a regular periodic schedule, which in turn has required certain operational changes and compliance adjustments. Non-compliance with the Residential Supervisory Location Designation Rule could subject us to fines, penalties or enforcement actions. We also face challenges due to the need to operate with a dispersed and remote workforce, as well as increased costs related to business continuity initiatives.

Previous wording

Allowing for remote work has in the past made and may continue to make it more difficult for us to preserve our corporate culture of innovation and our employees might have decreased opportunities to collaborate in meaningful ways. Further, we cannot guarantee that requiring a subset of employees to work in-office, or allowing certain employees to continue to work remotely, will not have a negative impact on employee morale or productivity. Any failure to overcome the challenges presented by our Return to Office policy and remote work policy could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively, maintain product development velocity, and execute on our business strategy.

Current wording

Allowing for remote work has in the past made and may continue to make it more difficult for us to preserve our corporate culture of innovation and our employees might have decreased opportunities to collaborate in meaningful ways. Further, we cannot guarantee that requiring a subset of employees to work in-office, or allowing certain employees to continue to work remotely, will not have a negative impact on employee morale or productivity. Any failure to overcome the challenges presented by our working model could harm our future success, including our ability to retain and recruit personnel, innovate and operate effectively, maintain product development velocity, and execute on our business strategy.

Previous wording

•In January 2024, we settled a matter with the MSD related to supervision of certain product features and marketing strategies, the March 2020 Outages, our options trading approval process, and the November 2021 Data Security Incident, under which we paid a $7.5 million fine and agreed to engage an independent consultant to review, among other things, implementation of the FINRA independent’s recommendations, policies and procedures regarding certain application features, and cybersecurity measures.

Current wording

•In January 2024, we settled a matter with the MSD related to supervision of certain product features and marketing strategies, the March 2020 Outages, and our options trading approval process, as well as the November 2021 Data Security Incident, under which we paid a $7.5 million fine and engaged an independent consultant to review, among other things, implementation of the FINRA independent’s recommendations, policies and procedures regarding certain application features, and cybersecurity measures.

Previous wording

Various lawmakers, regulators and other public officials have recently made statements about our business and that of other broker-dealers and signaled an increased focus on new or additional laws or regulations that, if acted upon, could impact our business. Over three days in the spring of 2021, the Committee on Financial Services of the U.S. House of Representatives held hearings on the January 2021 market volatility and disruptions surrounding GameStop and other “meme” stocks at which various members of Congress expressed concerns about various market practices, including PFOF and options trading. In his testimony, Chair Gensler indicated that he had instructed the the SEC Staff to study, and in some cases make rulemaking recommendations to the SEC regarding, a variety of market issues and practices, including PFOF, digital engagement practices, and whether broker-dealers are adequately disclosing their policies and procedures around potential trading restrictions; whether margin requirements and other payment requirements are sufficient; and whether broker-dealers have appropriate tools to manage their liquidity and risk. Chair Gensler also discussed the use of mobile app features such as rewards, bonuses, push notifications and other prompts. Chair Gensler suggested that such prompts could promote behavior that is not in the interest of the customer, such as excessive trading. Chair Gensler also advised that he had directed the SEC Staff to consider whether expanded enforcement mechanisms are necessary. In December 2022, the SEC proposed the December 2022 Rule Proposals, which relate to (i) best execution, (ii) order competition, (iii) order execution disclosure, and (iv) order tick size and fee caps. The SEC issued a request for information and public comment on digital engagement practices by broker-dealers and investment advisers in August 2021. In his April 2023 testimony before the U.S. House of Representatives Committee on Financial Services, Chair Gensler stated that he had asked the SEC Staff to make recommendations for rule proposals addressing conflicts that can arise from the use of predictive analytics, in particular conflicts that may arise to the extent advisors or brokers are optimizing their own interests as well as others. On July 26, 2023, the SEC proposed new rules (the “July 2023 Rule Proposals”) that would impose new obligations on registered broker-dealers and investment advisers with respect to their use of certain covered technologies when interacting with investors. If adopted as proposed, the July 2023 Rule Proposals may require us to modify, limit or discontinue our use of certain technologies and product features—and could significantly change the way that we interact with existing and prospective customers—which may adversely impact our business and revenues. From time to time, we have received requests from regulators, including from the SEC, regarding our collection and uses of customer data and related disclo…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Various lawmakers, regulators and other public officials have recently made statements about our business and that of other broker-dealers and signaled an increased focus on new or additional laws or regulations that, if acted upon, could impact our business. Over three days in the spring of 2021, the Committee on Financial Services of the U.S. House of Representatives held hearings on the January 2021 market volatility and disruptions surrounding GameStop and other “meme” stocks at which various members of Congress expressed concerns about various market practices, including PFOF and options trading. In his testimony, Chair Gensler indicated that he had instructed the SEC Staff to study, and in some cases make rulemaking recommendations to the SEC regarding, a variety of market issues and practices, including PFOF, digital engagement practices, and whether broker-dealers are adequately disclosing their policies and procedures around potential trading restrictions; whether margin requirements and other payment requirements are sufficient; and whether broker-dealers have appropriate tools to manage their liquidity and risk. Chair Gensler also discussed the use of mobile app features such as rewards, bonuses, push notifications and other prompts. Chair Gensler suggested that such prompts could promote behavior that is not in the interest of the customer, such as excessive trading. Chair Gensler also advised that he had directed the SEC Staff to consider whether expanded enforcement mechanisms are necessary. In December 2022, the SEC proposed the December 2022 Rule Proposals, which relate to (i) best execution, (ii) order competition, (iii) order execution disclosure, and (iv) order tick size and fee caps. The SEC issued a request for information and public comment on digital engagement practices by broker-dealers and investment advisers in August 2021. In his April 2023 testimony before the U.S. House of Representatives Committee on Financial Services, Chair Gensler stated that he had asked the SEC Staff to make recommendations for rule proposals addressing conflicts that can arise from the use of predictive analytics, in particular conflicts that may arise to the extent advisors or brokers are optimizing their own interests as well as others. On July 26, 2023, the SEC proposed new rules (the “July 2023 Rule Proposals”) that would impose new obligations on registered broker-dealers and investment advisers with respect to their use of certain covered technologies when interacting with investors. In May 2024, Chair Gensler indicated in multiple speeches that the SEC Staff was considering re-proposing modified versions of these rules and the SEC’s Spring 2024 regulatory flexibility agenda published in July 2024 indicates that a second notice of proposed rulemaking on this topic is scheduled for October 2024. However, if adopted as originally proposed, the July 2023 Rule Proposals may require us to modify, limit or discontinue our use of certain techno…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We currently use machine learning and AI to improve our products and processes in limited circumstances, such as to increase the efficiency of our in-app chat support and our fraud detection systems, and have plans to expand our use of AI in the future. Our research and development of such technology remains ongoing. As with many new and emerging technologies, AI presents numerous risks and challenges that could adversely affect our business. If we fail to keep pace with rapidly evolving AI technological developments, especially in the financial technology sector, our competitive position and business results may suffer. At the same time, use of AI has recently become the source of significant media attention and political debate. The introduction of AI technologies, particularly generative AI, into new or existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. For example, AI technologies can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could negatively impact our customers, harm our reputation and business, and expose us to liability. Laws, regulations or industry standards that develop in response to the use of AI may be burdensome or may restrict our ability to use, develop, or deploy AI, particularly generative AI technologies, in our products or processes.

Current wording

We currently use machine learning and AI to improve our products and processes in certain circumstances, such as to increase the efficiency of our in-app chat support, fraud detection systems, and software coding optimization, as well as via our acquisition of Pluto Capital, an AI powered investment research platform, and have plans to continue to expand our use of AI in the future. Our research and development of such technology also remains ongoing. As with many new and emerging technologies, AI presents numerous risks and challenges that could adversely affect our business. If we fail to keep pace with rapidly evolving AI technological developments, especially in the financial technology sector, our competitive position and business results may suffer. At the same time, use of AI has recently become the source of significant media attention and political debate. The introduction and use of AI technologies, particularly generative AI, into new or existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. For example, AI technologies can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could negatively impact our customers, harm our reputation and business, and expose us to liability. Laws, regulations or industry standards that develop in response to the use of AI may be burdensome or may restrict our ability to use, develop, or deploy AI, particularly generative AI technologies, in our products or processes, or our efforts to expand our business. For example, EU’s AI Act, which became effective on August 1, 2024, governs the development, marketing and use of AI in the EU and could impose significant additional costs on us to comply or significant fines for failing to comply.

Previous wording

We use AI technologies from third parties, which may include open source software. If we are unable to maintain rights to use these AI technologies on commercially reasonable terms, we may be forced to acquire or develop alternate AI technologies, which may limit or delay our ability to provide competitive offerings and may increase our costs. These AI technologies also may incorporate data from third-party sources, which may expose us to risks associated with data rights and protection. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including with respect to intellectual property ownership and license rights, cybersecurity, and data protection laws, among others, and has not been yet fully addressed by courts or regulators. The use, development, or adoption of AI technologies into our products may result in exposure to claims by third parties of copyright infringement or other intellectual property misappropriation, which may require us to pay compensation or license fees to third parties. The evolving legal, regulatory and compliance framework for AI technologies may also impact our ability to protect our own data and intellectual property against infringing use.

Current wording

We also use AI technologies from third parties, which may include open source software. If we are unable to maintain rights to use these AI technologies on commercially reasonable terms, we may be forced to acquire or develop alternate AI technologies, which may limit or delay our ability to provide competitive offerings and may increase our costs. These AI technologies also may incorporate data from third-party sources, which may expose us to risks associated with data rights and protection. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including with respect to intellectual property ownership and license rights, cybersecurity, and data protection laws, among others, and has not been yet fully addressed by courts or regulators. The use, development, or adoption of AI technologies into our products may result in exposure to claims by third parties of copyright infringement or other intellectual property misappropriation, which may require us to pay compensation or license fees to third parties. The evolving legal, regulatory and compliance framework for AI technologies may also impact our ability to protect our own data and intellectual property against infringing use.

Previous wording

Cybersecurity attacks and other malicious internet-based activity continue to increase and financial technology platform providers have been and expect to continue to be targeted. In light of media attention, we might be a particularly attractive target of attacks seeking to access customer data or assets. For example, from January 1, 2020 to October 16, 2020, approximately 2,000 Robinhood customer accounts were allegedly accessed by unauthorized users. We believe these incidents resulted from compromised passwords off of our platforms, rather than any failure of our security or systems. Nonetheless, we experienced negative publicity in connection with these events and might in the future experience similar adverse effects relating to real or perceived security incidents, whether or not related to the security of our platforms or systems. We have also received customer complaints and been subject to litigation and regulatory inquiries, examinations, enforcement actions, and investigations by various state and federal regulatory bodies, including the SEC, FINRA, and certain state regulators, including the NYDFS and the New York Attorney General, related to these events. The increasing sophistication and resources of cyber criminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security. Additionally, there is an increased risk that we might experience cybersecurity-related incidents as a result of any of our employees, service providers, or other third-parties working remotely on less secure systems and environments. While we take significant efforts to protect our systems and data, including establishing internal processes and implementing technological measures designed to provide multiple layers of security, our safety and security measures might be insufficient to prevent damage to, or interruption or breach of, our information systems, data (including personal data), and operations. For example, we experienced the November 2021 Data Security Incident. Based on our investigation and that of a third-party security firm, we believe that the unauthorized party obtained names or email addresses for millions of people, phone numbers for several thousand people, additional personal information for a few hundred people, and extensive account details for about ten people, though we believe no Social Security numbers, bank account numbers, or credit or debit card numbers were exposed and that there has been no financial loss to any customers as a result of the incident.

Current wording

Nonetheless, we experienced negative publicity in connection with these events and might in the future experience similar adverse effects relating to real or perceived security incidents, whether or not related to the security of our platforms or systems. We have also received customer complaints and been subject to litigation and regulatory inquiries, examinations, enforcement actions, and investigations by various state and federal regulatory bodies, including the SEC, FINRA, and certain state regulators, including the NYDFS and the New York Attorney General, related to these events. The increasing sophistication and resources of cyber criminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security. Additionally, there is an increased risk that we might experience cybersecurity-related incidents as a result of any of our employees, service providers, or other third-parties working remotely on less secure systems and environments. While we take significant efforts to protect our systems and data, including establishing internal processes and implementing technological measures designed to provide multiple layers of security, our safety and security measures might be insufficient to prevent damage to, or interruption or breach of, our information systems, data (including personal data), and operations. For example, we experienced the November 2021 Data Security Incident. Based on our investigation and that of a third-party security firm, we believe that the unauthorized party obtained names or email addresses for millions of people, phone numbers for several thousand people, additional personal information for a few hundred people, and extensive account details for about ten people, though we believe no Social Security numbers, bank account numbers, or credit or debit card numbers were exposed and that there has been no financial loss to any customers as a result of the incident.

Previous wording

Furthermore, to the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees might increase. Third-party risks might include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws or security measures might be inadequate. Our ability to monitor, and our resources to optimize integration with, third-party service providers’ data security practices are also limited. These third-party risks might be exacerbated as our resources are spread across multiple public cloud service providers. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, such agreements might not prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of, or modification of data (including personal data) and/or might not enable us to obtain adequate (or any) reimbursement from our third-party service providers in the event we should suffer any such incidents. For example, the massive, nearly two-year long, cybersecurity attack against SolarWinds Corp., known as the SUNBURST attack, highlights the growing risk from cybersecurity threats against trusted third-party software which can lead to thousand of customers’ data being compromised. Due to applicable laws and regulations or contractual obligations, we could be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our third-party solutions. Additionally, we could also be exposed to information security vulnerabilities or failures at third parties’ common suppliers or vendors (known as “fourth parties”) that could also impact the security of our data, and we may not be able to effectively directly monitor or mitigate such fourth-party risks, in particular as such risks relate to the use of common suppliers or vendors by the third parties that perform functions and services for us and our limited ability to assess the fourth party’s operational controls.

Current wording

Furthermore, to the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees might increase. Third-party risks might include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws or security measures might be inadequate. Our ability to monitor, and our resources to optimize integration with, third-party service providers’ data security practices are also limited. These third-party risks might be exacerbated as our resources are spread across multiple public cloud service providers. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, such agreements might not prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of, or modification of data (including personal data) and/or might not enable us to obtain adequate (or any) reimbursement from our third-party service providers in the event we should suffer any such incidents. For example, the massive, nearly two-year long, cybersecurity attack against SolarWinds Corp., known as the SUNBURST attack, highlights the growing risk from cybersecurity threats against trusted third-party software which can lead to thousands of customers’ data being compromised. Due to applicable laws and regulations or contractual obligations, we could be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our third-party solutions. Additionally, we could also be exposed to information security vulnerabilities or failures at third parties’ common suppliers or vendors (known as “fourth parties”) that could also impact the security of our data, and we may not be able to effectively directly monitor or mitigate such fourth-party risks, in particular as such risks relate to the use of common suppliers or vendors by the third parties that perform functions and services for us and our limited ability to assess the fourth party’s operational controls.

Previous wording

All customers can place limit orders to buy whole shares of the most traded ETFs and individual stocks – 24 hours a day, five days a week, through Robinhood 24 Hour Market. Offering U.S. stock trading overnight has heightened risks related to our clearing and execution activities as we do not have previous experience operating or staffing our systems for around-the-clock coverage and may not be able to accurately anticipate the volume of trading activity that will occur outside of regular market hours. Overnight trading on Robinhood 24 Hour Market is primarily supported by Blue Ocean ATS, LLC (“BOATS”), a trading venue that replicates the role that stock exchanges play during regular market hours. If BOATS becomes unwilling or unable to do business with us or one of our market makers in the future, we may be unable to find another trading platform to support Robinhood 24 Hour Market, which could negatively impact our transaction-based revenue and generate negative publicity. Additionally, any disruptions in the services provided by BOATS, whether due to technical malfunctions, operational mishaps, or external factors such as regulatory changes or market volatility, have in the past, and may in the future impair our ability to execute our client's orders. Should BOATS experience downtime or diminished performance, particularly during overnight trading hours, our ability to execute customer orders through Robinhood 24 Hour Market could be compromised and could have an adverse impact on our business, financial condition and results of operations, and/or brand and reputation.

Current wording

All customers can place limit orders to buy whole shares of the most traded exchange-traded funds (“ETFs”) and individual stocks – 24 hours a day, five days a week, through Robinhood 24 Hour Market. Offering U.S. stock trading overnight has heightened risks related to our clearing and execution activities as we do not have previous experience operating or staffing our systems for around-the-clock coverage and may not be able to accurately anticipate the volume of trading activity that will occur outside of regular market hours. Overnight trading on Robinhood 24 Hour Market is primarily supported by Blue Ocean ATS, LLC (“BOATS”), a trading venue that replicates the role that stock exchanges play during regular market hours. If BOATS becomes unwilling or unable to do business with us or one of our market makers in the future, we may be unable to find another trading platform to support Robinhood 24 Hour Market, which could negatively impact our transaction-based revenue and generate negative publicity. Additionally, any disruptions in the services provided by BOATS, whether due to technical malfunctions, operational mishaps, or external factors such as regulatory changes or market volatility, have in the past, and may in the future impair our ability to execute our client's orders. Should BOATS experience downtime or diminished performance (as it has in the past and could again in the future), particularly during overnight trading hours, our ability to execute customer orders through Robinhood 24 Hour Market could be compromised and could have an adverse impact on our business, financial condition, results of operations, and/or brand and reputation. For example, on August 5, 2024, BOATS did not open for overnight trading and as a result, Robinhood customers were unable to execute any trades during that overnight session.

Previous wording

Additionally, the SEC finalized rules in February 2023 to shorten the standard settlement cycle for most broker-dealer transactions in securities from two business days after the trade (T+2) to one (T+1), which will become effective on May 28, 2024. The shortening of the settlement cycle will lead to a reduction in the length of exposure to trading counterparties and lower margin requirements for our clearing operations, but it is also expected to require technological, operational, and compliance adjustments across the industry that are likely to be time consuming and costly for all market participants and which could increase the risk of operational errors, any of which could be material in light of the magnitude and volume of our settlement-related activities and obligations.

Current wording

Additionally, the SEC finalized rules in February 2023 to shorten the standard settlement cycle for most broker-dealer transactions in securities from two business days after the trade (T+2) to one (T+1), which became effective on May 28, 2024. The shortening of the settlement cycle has lead to a reduction in the length of exposure to trading counterparties and lower margin requirements for our clearing operations, but it has also required technological, operational, and compliance adjustments across the industry that have been and are likely to continue to be time consuming and costly for all market participants and which has increased and could continue to increase the risk of operational errors, any of which could be material in light of the magnitude and volume of our settlement-related activities and obligations.

Previous wording

Risks associated with providing investment recommendations include those arising from how we disclose and address possible conflicts of interest, inadequate due diligence, inadequate disclosure, and human error. Regulations, such as the SEC’s Regulation Best Interest and certain state broker-dealer regulations, impose heightened conduct standards and requirements on recommendations to retail investors. For example, in September 2023, the North American Securities Association (“NASAA”) (an association of state securities administrators) proposed revisions to the NASAA model rule regarding Dishonest or Unethical Business Practices of Broker-Dealers and Agents, which are intended to address Regulation Best Interest and other developments in the securities industry. In addition, various states are considering potential regulations or have already adopted certain regulations that could impose additional standards of conduct or other obligations on us to the extent we provide investment advice or recommendations to our customers. The SEC’s July 2023 Rule Proposals, if adopted as proposed, would impose new requirements with respect to our use of a wide range of covered technologies when we are engaging or communicating with existing and prospective customers. If adopted as proposed, the proposals may require us to modify, limit or discontinue our use of certain technologies and product features—and would introduce new regulatory considerations or requirements that would apply to our communications and interactions with existing and prospective customers, including to the extent we provide investment advice or recommendations to them.

Current wording

Risks associated with providing investment recommendations include those arising from how we disclose and address possible conflicts of interest, inadequate due diligence, inadequate disclosure, and human error. Regulations, such as the SEC’s Regulation Best Interest and certain state broker-dealer regulations, impose heightened conduct standards and requirements on recommendations to retail investors. For example, in September 2023, the North American Securities Association (“NASAA”) (an association of state securities administrators) proposed revisions to the NASAA model rule regarding Dishonest or Unethical Business Practices of Broker-Dealers and Agents, which are intended to address Regulation Best Interest and other developments in the securities industry. In addition, various states are considering potential regulations or have already adopted certain regulations that could impose additional standards of conduct or other obligations on us to the extent we provide investment advice or recommendations to our customers. The SEC’s July 2023 Rule Proposals, if adopted as originally proposed, would impose new requirements with respect to our use of a wide range of covered technologies when we are engaging or communicating with existing and prospective customers. If adopted as originally proposed, the proposals may require us to modify, limit or discontinue our use of certain technologies and product features—and would introduce new regulatory considerations or requirements that would apply to our communications and interactions with existing and prospective customers, including to the extent we provide investment advice or recommendations to them.

Previous wording

Any particular cryptocurrency’s status as a “security” is subject to a high degree of uncertainty and if we have not properly characterized one or more cryptocurrencies, we might be subject to regulatory scrutiny, investigations, fines, and other penalties.

Current wording

In the United States, any particular cryptocurrency’s status as a “security” is subject to a high degree of uncertainty and if we have not properly characterized one or more cryptocurrencies, we might be subject to regulatory scrutiny, investigations, fines, and other penalties.

Previous wording

We currently facilitate customer trades for certain cryptocurrencies that we have analyzed under applicable internal policies and procedures and, for cryptocurrencies supported on our the RHC platform, that we believe are not securities under U.S. federal and state securities laws. Determining whether any given cryptocurrency is a security is a highly complex, fact-driven analysis, the outcome of which is difficult to predict and may evolve over time based on changes in the cryptocurrency and its related ecosystem. Different parties may reach different conclusions about the outcome of this analysis based on the same facts. The analysis may become clearer depending on the outcome in certain cases currently pending in varying stages of litigation. The SEC Staff has indicated that the determination of whether or not a cryptocurrency is a security depends on the characteristics and use of that particular asset. The SEC and the SEC Staff have taken positions that certain cryptocurrenciesare “securities” in the context of settled or litigated enforcement actions – and we do not currently support any cryptocurrencies in the U.S. for which the SEC or the SEC Staff has taken such a position. Otherwise, the SEC has not historically provided advance confirmation on the status of any particular cryptocurrency as a security. While prior public statements by senior officials at the SEC indicated that the SEC does not intend to take the position that Bitcoin or Ethereum are securities (in their current forms), Bitcoin and Ethereum were the only specific cryptocurrencies as to which senior officials at the SEC had publicly expressed such a view. However, Chair Gensler was quoted in a February 2023 interview as saying “[e]verything other than Bitcoin” when discussing the SEC’s purview with respect to cryptocurrency and in April 2023 declined to provide his view when asked if he considered Ethereum to be a security during his testimony to the U.S. House of Representatives Financial Services Committee. Moreover, such statements are not official policy statements by the SEC and reflect only the speakers’ views, which are not binding on the SEC or any other agency or court, cannot be generalized to any other cryptocurrency, and might evolve. Similarly, although the SEC’s Strategic Hub for Innovation and Financial Technology published a framework for analyzing whether any given cryptocurrency is a security in April 2019, this framework is also not a rule, regulation, or statement of the SEC and is not binding on the SEC. With respect to all other cryptocurrencies, there is currently no certainty under the applicable legal test that such assets are not securities, and U.S. regulators have expressed concerns about cryptocurrency platforms adding multiple new coins, some of which the regulators question might be unregistered securities. In September 2022, Chair Gensler stated in a speech that he believes a vast majority of the nearly 10,000 tokens in the crypto market ar…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We currently facilitate customer trades for certain cryptocurrencies that we have analyzed under applicable internal policies and procedures and, for cryptocurrencies supported on our the RHC platform, that we believe are not securities under U.S. federal and state securities laws. Determining whether any given cryptocurrency is a security is a highly complex, fact-driven analysis, the outcome of which is difficult to predict and may evolve over time based on changes in the cryptocurrency and its related ecosystem. Different parties may reach different conclusions about the outcome of this analysis based on the same facts. The analysis may become clearer depending on the outcome in certain cases currently pending in varying stages of litigation. The SEC Staff has indicated that the determination of whether or not a cryptocurrency is a security depends on the characteristics and use of that particular asset. The SEC and the SEC Staff have taken positions that certain cryptocurrenciesare “securities” in the context of settled or litigated enforcement actions – and we do not currently support any cryptocurrencies in the U.S. for which the SEC or the SEC Staff has taken such a position. Otherwise, the SEC has not historically provided advance confirmation on the status of any particular cryptocurrency as a security. While prior public statements by senior officials at the SEC indicated that the SEC does not intend to take the position that Bitcoin or Ethereum are securities (in their current forms), Bitcoin and Ethereum were the only specific cryptocurrencies as to which senior officials at the SEC had publicly expressed such a view. Moreover, such statements are not official policy statements by the SEC and reflect only the speakers’ views, which are not binding on the SEC or any other agency or court, cannot be generalized to any other cryptocurrency, and might evolve. For example, Chair Gensler was quoted in a February 2023 interview as saying “[e]verything other than Bitcoin” when discussing the SEC’s purview with respect to cryptocurrency and in April 2023 declined to provide his view when asked if he considered Ethereum to be a security during his testimony to the U.S. House of Representatives Financial Services Committee. In May 2024, however, the SEC approved the listing and trading of ETFs whose assets include Ethereum on SEC-regulated exchanges; some view this approval as an implicit acknowledgement by the SEC that Ethereum is not necessarily a security. Similarly, although the SEC’s Strategic Hub for Innovation and Financial Technology published a framework for analyzing whether any given cryptocurrency is a security in April 2019, this framework is also not a rule, regulation, or statement of the SEC and is not binding on the SEC. With respect to all other cryptocurrencies, there is currently no certainty under the applicable legal test that such assets are not securities, and U.S. regulators have expressed concerns about cryptocurrency p…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Domestic and foreign regulators and governments are increasingly focused on the regulation of cryptocurrencies. In the United States, cryptocurrencies are regulated by both federal and state authorities, depending on the context of their usage. Cryptocurrency market disruptions and resulting governmental interventions are unpredictable, and might make cryptocurrencies, or certain cryptocurrency business activities, illegal altogether. As regulation of cryptocurrencies continues to evolve, there is a substantial risk of inconsistent regulatory guidance among federal and state agencies and among state governments which, along with potential accounting and tax issues or other requirements relating to cryptocurrencies, could impede the growth of our cryptocurrency operations. Additionally, regulation in response to the climate impact of cryptocurrency mining could negatively impact cryptocurrency trading on our platforms.

Current wording

Domestic and foreign regulators and governments are increasingly focused on the regulation of cryptocurrencies. In the United States, cryptocurrencies are regulated by both federal and state authorities, depending on the context of their usage. Cryptocurrency market disruptions and resulting governmental interventions are unpredictable, and might make cryptocurrencies, or certain cryptocurrency business activities, illegal altogether. As regulation of cryptocurrencies continues to evolve, there is a substantial risk of inconsistent regulatory guidance among federal and state agencies and among state governments which, along with potential accounting and tax issues or other requirements relating to cryptocurrencies, could impede the growth of our cryptocurrency operations. The outcome of the upcoming presidential and Congressional elections in the U.S. also presents considerable uncertainty as to future cryptocurrency regulations. Additionally, regulation in response to the climate impact of cryptocurrency mining could negatively impact cryptocurrency trading on our platforms.

Previous wording

Furthermore, the Infrastructure Investment and Jobs Act significantly changes the tax reporting requirements applicable to brokers and holders of cryptocurrency and digital assets. On August 25, 2023, the Treasury Department and Internal Revenue Service released proposed regulations on the sale and exchange of digital assets by brokers. In particular, the proposed regulations would require basis tracking for digital assets that are treated as “covered securities” if acquired on or after January 1, 2023 and information reporting by digital asset brokers on certain digital asset sales or exchanges that occur on or after January 1, 2025. The implementation of these requirements, and any further legislative changes or related guidance from the Internal Revenue Service, might significantly impact our tax reporting and withholding processes and result in increased compliance costs. Failure to comply with these new information reporting and withholding requirements might subject us to significant tax liabilities and penalties. Similarly, the Organization for Economic Cooperation and Development has published final guidance on a new “crypto-asset reporting framework” and amendments to the existing rules for reporting crypto assets under the global “common reporting standard” that might apply to our international operations. These new rules might give rise to potential liabilities or disclosure requirements, and implementation of these requirements might significantly impact our operations and result in increased costs.

Current wording

Furthermore, the Infrastructure Investment and Jobs Act significantly changes the tax reporting requirements applicable to brokers and holders of cryptocurrency and digital assets. On August 25, 2023, the Treasury Department and Internal Revenue Service released proposed regulations on the sale and exchange of digital assets by brokers. On June 28, 2024, final regulations were released that require information reporting by digital asset brokers on certain digital asset sales or exchanges that occur on or after January 1, 2025, and basis tracking for digital assets that are treated as “covered securities” if acquired on or after January 1, 2026. The implementation of these requirements, and any further legislative changes or related guidance from the Internal Revenue Service, might significantly impact our tax reporting and withholding processes and result in increased compliance costs. Failure to comply with these new information reporting and withholding requirements might subject us to significant tax liabilities and penalties. Similarly, the Organization for Economic Cooperation and Development has published final guidance on a new “crypto-asset reporting framework” and amendments to the existing rules for reporting crypto assets under the global “common reporting standard” that might apply to our international operations. These new rules might give rise to potential liabilities or disclosure requirements, and implementation of these requirements might significantly impact our operations and result in increased costs.

Previous wording

Our international expansion also subjects us to additional laws, regulations, or other government or regulatory scrutiny as discussed in “—Risks Related to Our Business—We recently started operating in certain international markets and plan to further expand our international operations, which exposes us to significant new risks, and our international expansion efforts might not succeed.” For example, when the provisions of Markets in the Crypto Asset Regulation (“MiCA”) take effect on December 30, 2024, we will be subject to the authorization, compliance, and disclosure regime of MiCA for crypto asset service providers (“CASP”) and issuers of certain crypto assets. We will need to obtain a MiCA compliant CASP license in our home member state and compliance with such regulation will require the implementation of new systems and processes, and updates to our policies. While MiCA provides member states with the option of implementing a transitional period from December 30, 2024 to July 1, 2026, at this time, Lithuania’s Ministry of Finance and the Bank of Lithuania have proposed a MiCA transitional period for registrants in Lithuania to June 1, 2025. The relevant Lithuanian authorities are actively preparing for MiCA regulation, but the application process in Lithuania has not yet been finalized. Notwithstanding the transitional period, however, if we are unable to obtain a MiCA compliant CASP license by the end of the year, we may need to cease operations in several member states in the EU. Obtaining a MiCA compliant

Current wording

Our international expansion also subjects us to additional laws, regulations, or other government or regulatory scrutiny as discussed in “—Risks Related to Our Business—We recently started operating in certain international markets and plan to further expand our international operations, which exposes us to significant new risks, and our international expansion efforts might not succeed.” For example, when the provisions of Markets in the Crypto Asset Regulation (“MiCA”) take effect on December 30, 2024, we will be subject to the authorization, compliance, and disclosure regime of MiCA for crypto asset service providers (“CASP”) and issuers of certain crypto assets. We will need to obtain a MiCA compliant CASP license in our home member state and compliance with such regulation will require the implementation of new systems and processes, and updates to our policies. While MiCA provides member states with the option of implementing a transitional period from December 30, 2024 to July 1, 2026, at this time, Lithuania’s Ministry of Finance and the Bank of Lithuania have proposed a MiCA transitional period for registrants in Lithuania to June 1, 2025. The relevant Lithuanian authorities are actively preparing for MiCA regulation, but the application process in Lithuania has not yet been finalized. Notwithstanding the transitional period, however, if we are unable to obtain a MiCA compliant CASP license by the end of the year, we may need to cease operations in several member states in the EU. Obtaining a MiCA compliant CASP license in our home EU member state could take longer than we expect and would adversely affect our international operations.

Previous wording

In the United States, we allow customers to deposit and withdraw cryptocurrencies to and from our RHC platform through our Crypto Transfers feature in the states in which RHC operates (other than New York, where our regulatory application is still pending). Crypto Transfers are processed using Robinhood’s general custodial infrastructure in which we hold some cryptocurrencies on behalf of customers; when transactions are completed, coins are allocated to and from individuals’ accounts in our customer records. Additionally, U.S. customers have access to a fiat-to-crypto on-ramp tool that developers can embed directly into their decentralized applications (“Robinhood Connect”), allowing their customers to use their RHC accounts to buy and transfer crypto, and fund their self-custody wallets.

Current wording

In the United States, we allow customers to deposit and withdraw cryptocurrencies to and from our RHC platform through our Crypto Transfers feature in the states in which RHC operates (other than New York, where our regulatory application is still pending). Since July 2024, we also allow customers in select jurisdictions in the EU to deposit crypto onto our RHEC platform, and expect to also be able to allow customers to withdraw crypto from our RHEC platform soon. Crypto Transfers are processed using Robinhood’s general custodial infrastructure in which we hold some cryptocurrencies on behalf of customers; when transactions are completed, coins are allocated to and from individuals’ accounts in our customer records. Additionally, U.S. customers have access to a fiat-to-crypto on-ramp tool that developers can embed directly into their decentralized applications (“Robinhood Connect”), allowing their customers to use their RHC accounts to buy and transfer crypto, and fund their self-custody wallets.

Previous wording

Crypto Transfers initiated by users are subject to a heightened risk of user error. Under blockchain protocol, recording a transfer of cryptocurrency on the blockchain involves both the private key of the sending wallet and the unique public key of the receiving wallet. Such keys are strings of alphanumeric characters. In order for a customer to receive cryptocurrency on our RHC platform, the customer will need to arrange for the owner of an external source wallet to “sign” a transaction with the private key of that external wallet, directing a transfer of the cryptocurrency to our receiving custodial wallet by inputting the public key (which we will provide to the customer) of our custodial wallet. Similarly, in order to withdraw cryptocurrency from our RHC platform, the customer will need to provide us with the public key of the external wallet to which the cryptocurrency is to be transferred, and we will “sign” the transaction using the private key of our wallet. Some crypto networks might require additional information to be provided in connection with any transfer of cryptocurrency to or from our RHC platform. A number of errors could occur in the process of depositing or withdrawing cryptocurrencies to or from our RHC platform, such as typos, mistakes, or the failure to include information required by the blockchain network. For instance, a user might include typos when entering our custodial wallet’s public key or the desired recipient’s public key when depositing to and withdrawing from our RHC platform, respectively. Alternatively, a user could mistakenly transfer cryptocurrencies to a wallet address that he or she does not own or control, or for which the user has lost the private key. In addition, each wallet address is compatible only with the underlying blockchain network on which it is created. For instance, a Bitcoin wallet address can be used to send and receive Bitcoin only. If any Ethereum, Dogecoin, or other cryptocurrency is sent to a Bitcoin wallet address, for example, or if any of the other foregoing errors occur, such cryptocurrencies could be permanently and irretrievably lost with no means of recovery.

Current wording

Crypto Transfers initiated by users are subject to a heightened risk of user error. Under blockchain protocol, recording a transfer of cryptocurrency on the blockchain involves both the private key of the sending wallet and the unique public key of the receiving wallet. Such keys are strings of alphanumeric characters. In order for a customer to receive cryptocurrency on our platforms, the customer will need to arrange for the owner of an external source wallet to “sign” a transaction with the private key of that external wallet, directing a transfer of the cryptocurrency to our receiving custodial wallet by inputting the public key (which we will provide to the customer) of our custodial wallet. Similarly, in order to withdraw cryptocurrency from our platforms, the customer will need to provide us with the public key of the external wallet to which the cryptocurrency is to be transferred, and we will “sign” the transaction using the private key of our wallet. Some crypto networks might require additional information to be provided in connection with any transfer of cryptocurrency to or from our platforms. A number of errors could occur in the process of depositing or withdrawing cryptocurrencies to or from our platforms, such as typos, mistakes, or the failure to include information required by the blockchain network. For instance, a user might include typos when entering our custodial wallet’s public key or the desired recipient’s public key when depositing to and withdrawing from our platforms, respectively. Alternatively, a user could mistakenly transfer cryptocurrencies to a wallet address that he or she does not own or control, or for which the user has lost the private key. In addition, each wallet address is compatible only with the underlying blockchain network on which it is created. For instance, a Bitcoin wallet address can be used to send and receive Bitcoin only. If any Ethereum, Dogecoin, or other cryptocurrency is sent to a Bitcoin wallet address, for example, or if any of the other foregoing errors occur, such cryptocurrencies could be permanently and irretrievably lost with no means of recovery.

Previous wording

With Robinhood Wallet, our self-custody, web3 wallet, customers have sole access and control over their cryptocurrencies on certain networks and personally hold and maintain their private keys. Although we do not custody cryptocurrencies held in a customer’s Robinhood Wallet and do not have access to customers’ private keys, customers who lose their private keys, and thus access to their Robinhood Wallet balances, may react negatively. Although our account agreements for Crypto Transfers and licensing agreements for Robinhood Wallet disclaim responsibility for losses caused by customer errors, such incidents could result in customer disputes, damage to our brand and reputation, legal claims against us, and financial liabilities.

Current wording

With Robinhood Wallet, our self-custody, web3 wallet, users have sole access and control over their cryptocurrencies on certain networks and personally hold and maintain their private keys. Although we do not custody cryptocurrencies held in a user’s Robinhood Wallet and do not have access to users’ private keys, users who lose their private keys, and thus access to their Robinhood Wallet balances, may react negatively. Although our account agreements for Crypto Transfers and licensing agreements for Robinhood Wallet disclaim responsibility for losses caused by user errors, such incidents could result in user disputes, damage to our brand and reputation, legal claims against us, and financial liabilities.

Previous wording

Additionally, allowing customers to deposit and withdraw cryptocurrencies to and from our RHC platform increases the risk thatour RHC platform might be exploited to facilitate illegal activity such as fraud, gambling, money laundering, tax evasion, and scams. Crypto Transfers, Robinhood Wallet, and Robinhood Connect also expose us to heightened risks related to potential violations of trade sanctions, including OFAC regulations, and anti-money laundering and counter-terrorist financing laws, which among other things impose strict liability for transacting with prohibited persons. We engage blockchain analytics vendors to help determine whether the external wallets involved in Crypto Transfers are controlled by persons on prohibited lists or involved in fraudulent or illegal activity. However, fraudulent and illegal transactions and prohibited status could be difficult or impossible for us and our vendors to detect in some circumstances. The use of our platforms for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in significant liabilities and reputational harm for us and could cause cryptocurrency trading volumes and transaction-based revenues to decline.

Current wording

Additionally, allowing customers to deposit and withdraw cryptocurrencies to and from our platforms increases the risk thatour platforms might be exploited to facilitate illegal activity such as fraud, gambling, money laundering, tax evasion, and scams. Crypto Transfers, Robinhood Wallet, and Robinhood Connect also expose us to heightened risks related to potential violations of trade sanctions, including OFAC regulations, and anti-money laundering and counter-terrorist financing laws, which among other things impose strict liability for transacting with prohibited persons. We engage blockchain analytics vendors to help determine whether the external wallets involved in Crypto Transfers are controlled by persons on prohibited lists or involved in fraudulent or illegal activity. However, fraudulent and illegal transactions and prohibited status could be difficult or impossible for us and our vendors to detect in some circumstances. The use of our platforms for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in significant liabilities and reputational harm for us and could cause cryptocurrency trading volumes and transaction-based revenues to decline.

Previous wording

Transfer Act and Regulation E as implemented by the CFPB. As a result of Robinhood Credit, we are also subject to a number of state licensing and other regulatory requirements and to payment card association operating rules, including data security rules and certification requirements, which could change or be reinterpreted to make it difficult or impossible for us to comply. Failure to obtain or maintain these licenses or to comply with these rules or requirements, as well as any breach, compromise, or failure to otherwise detect or prevent fraudulent activity involving our data security systems, could result in our being liable for card issuing banks’ costs, and subject to fines and higher transaction fees. Violations of any of these requirements could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

Current wording

As a result of the stored value Spending Account program and the Robinhood Cash Card, we are subject to federal and state consumer protection laws and regulations, including the Electronic Fund Transfer Act and Regulation E as implemented by the CFPB. As a result of Robinhood Credit, we are also subject to a number of state licensing and other regulatory requirements and to payment card association operating rules, including data security rules and certification requirements, which could change or be reinterpreted to make it difficult or impossible for us to comply. Robinhood Credit is in the process of acquiring licenses in all states where required to do so and is discussing with regulators, such as the Nebraska Department of Banking and Finance, certain prior related activity. Failure to obtain or maintain these licenses, failure to comply with these rules or requirements, or conducting such activity without a license, as well as any breach, compromise, or failure to otherwise detect or prevent fraudulent activity involving our data security systems, could result in our being liable for card issuing banks’ costs, and subject to regulatory fines, penalties, or criminal charges. Violations of any of these requirements could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.