Chime Financial, Inc.

Previous wording

We rely on our bank partners to provide the banking services offered through our platform, such as opening and maintaining member bank accounts, issuing Chime-branded debit and credit cards, and providing short-term loans to our members to support the liquidity products offered through our platform. Our relationships with our bank partners are a crucial part of our business as we do not have a banking license.

Current wording

We rely on our bank partners to provide the banking services offered through our platform, such as opening and maintaining member bank accounts, issuing Chime-branded debit and credit cards, and providing short-term loans to our members to support the liquidity products offered through our platform. Our relationships with our bank partners are a crucial part of our business as we do not currently have a banking license, and will remain relevant to our member relationships even if and when the Stride Acquisition closes.

Previous wording

We partner with The Bancorp Bank, N.A. (“Bancorp”) pursuant to a master services agreement (as amended, the “Bancorp MSA”) and with Stride Bank, N.A. (“Stride”) pursuant to two main agreements: an amended and restated agreement covering debit card issuance and private label checking and savings accounts (the “Stride Debit Agreement”), and a secured credit card issuing and marketing agreement for secured credit card programs (as amended, the “Stride Credit Agreement” and together with the Stride Debit Agreement, the “Stride Agreements”). The Bancorp MSA has an initial 60-month term ending in July 2028, while the Stride Agreements each have initial 36-month terms ending in November 2025 and have auto-renewed for an additional one-year term. Our bank partner agreements automatically renew for successive one-year periods unless either party provides written notice of non-renewal, which can be provided without cause to the other party at least 365 days, in the case of the Bancorp MSA, and at least 180 days, in the case of the Stride Agreements, prior to the end of any such term, or unless earlier terminated for cause. We and our bank partners can terminate the bank partner agreements early for cause upon the occurrence of certain early termination events, subject to certain fees that may be owed by Chime. In the event a bank partner agreement is terminated without cause, we can elect, subject to regulatory approval, to engage in a plan to transition our products to a successor bank partner or to develop a wind-down plan. In both cases, parties are contractually obligated to ensure a smooth transition or wind-down for our members, but we cannot guarantee the outcome of such transition or wind-down. In addition to the Bancorp MSA, Stride Agreements, and their addenda, we and/or our subsidiaries are party to certain other agreements with our bank partners.

Current wording

We partner with Bancorp pursuant to a master services agreement (as amended, the “Bancorp MSA”) and with Stride pursuant to two main agreements: an amended and restated agreement covering debit card issuance and private label checking and savings accounts (the “Stride Debit Agreement”), and a secured credit card issuing and marketing agreement for secured credit card programs (as amended, the “Stride Credit Agreement” and together with the Stride Debit Agreement, the “Stride Agreements”). The Bancorp MSA has an initial 60-month term ending in July 2028, while the Stride Agreements each have initial 36-month terms ending in November 2025 and have auto-renewed for an additional one-year term ending in November 2026. We expect that the Stride Agreements will auto-renew in November 2026 and will remain in effect on the same terms through at least the closing of the Stride Acquisition. Our bank partner agreements automatically renew for successive one-year periods unless either party provides written notice of non-renewal, which can be provided without cause to the other party at least 365 days, in the case of the Bancorp MSA, and at least 180 days, in the case of the Stride Agreements, prior to the end of any such term, or unless earlier terminated for cause. We and our bank partners can terminate the bank partner agreements early for cause upon the occurrence of certain early termination events, subject to certain fees that may be owed by Chime. In the event a bank partner agreement is terminated without cause, we can elect, subject to regulatory approval, to engage in a plan to transition our products to a successor bank partner or to develop a wind-down plan. In both cases, parties are contractually obligated to ensure a smooth transition or wind-down for our members, but we cannot guarantee the outcome of such transition or wind-down. In addition to the Bancorp MSA, Stride Agreements, and their addenda, we and/or our subsidiaries are party to certain other agreements with our bank partners.

Previous wording

Further, we earn the substantial majority of our revenue through interchange-based fees when our members use their Chime-branded debit or credit cards. See the risk factor titled “Changes in rules and practices regarding interchange fees, card network fees, and other fees and assessments may adversely affect our business, financial condition, and results of operations.” We are dependent on our bank partners’ compliance with card network requirements. We also depend in part on the maintenance of our bank partners’ qualification for the small issuer exemption, which exempts certain banks from the regulated limitations on debit card interchange fees imposed by the Durbin Amendment (the “Durbin Amendment”) to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), and if any of our bank partners were to become subject to such limitations on debit card interchange fees, our payments revenue may be harmed and our business, financial condition, and results of operations may be adversely affected. The continued growth of our business and, in particular, the expansion of banking services provided through our platform by our bank partners, could itself put pressure on our bank partners’

Current wording

Further, we earn the substantial majority of our revenue through interchange-based fees when our members use their Chime-branded debit or credit cards. See the risk factor titled “Changes in rules and practices regarding interchange fees, card network fees, and other fees and assessments may adversely affect our business, financial condition, and results of operations.” We are dependent on our bank partners’ compliance with card network requirements. We also depend in part on the maintenance of our bank partners’ qualification for the small issuer exemption, which exempts certain banks from the regulated limitations on debit card interchange fees imposed by the Durbin Amendment (the “Durbin Amendment”) to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), and if any of our bank partners were to become subject to such limitations on debit card interchange fees, our payments revenue may be harmed and our business, financial condition, and results of operations may be adversely affected. The continued growth of our business and, in particular, the expansion of banking services provided through our platform by our bank partners, could itself put pressure on our bank partners’ ability to qualify for the small issuer exemption from the interchange limits established pursuant to the Durbin Amendment. If this happens and we are not able to find additional bank partners to provide products through our platform, then our growth may be limited.

Previous wording

There are also regulatory risks associated with interchange fees. The Durbin Amendment required the Federal Reserve Board to promulgate regulations governing debit card interchange fees, card network exclusivity, and transaction routing. Accordingly, the Federal Reserve Board promulgated Regulation II. The Durbin Amendment and Regulation II exempt issuing banks that, together with their affiliates, have assets less than $10 billion from the limitations on the amount of debit card interchange fees. While our bank partners are currently exempt from the limitations on debit card interchange fees, and we expect them to continue to be exempt, we can offer no assurance or guarantee that they will remain exempt, and various events outside our control may cause our bank partners to become subject to the interchange fee limits in Regulation II. To the extent that we seek to develop a relationship with a new bank partner, there is no assurance that it will be exempt. See the risk factor titled “Our relationships with our bank partners are crucial to our business, and we may be unable to maintain our relationship with either of our bank partners, which may adversely affect our business, financial condition, and results of operations.”

Current wording

There are also regulatory risks associated with interchange fees. The Durbin Amendment required the Federal Reserve Board to promulgate regulations governing debit card interchange fees, card network exclusivity, and transaction routing. Accordingly, the Federal Reserve Board promulgated Regulation II. The Durbin Amendment and Regulation II exempt issuing banks that, together with their affiliates, have assets less than $10 billion from the limitations on the amount of debit card interchange fees. While our bank partners are currently exempt from the limitations on debit card interchange fees, and we expect them to continue to be exempt, we can offer no assurance or guarantee that they will remain exempt, and various events outside our control may cause our bank partners to become subject to the interchange fee limits in Regulation II. In addition, following the completion of the Stride Acquisition, Stride’s assets will be aggregated with those of its affiliates, including us, for purposes of determining whether Stride qualifies for the small issuer exemption. Although we currently expect that the combined assets of Stride and its affiliates will remain below $10 billion for the foreseeable future, that may change, including as a result of our growth or the consolidation of our banking activities at Stride. To the extent that we seek to develop a relationship with a new bank partner, there is no assurance that it will be exempt. See the risk factor titled “Our relationships with our bank partners are crucial to our business, and we may be unable to maintain our relationship with either of our bank partners, which may adversely affect our business, financial condition, and results of operations.”

Previous wording

In addition to our bank partners, we rely on third parties in connection with our products, including, but not limited to: card networks, payment gateways, and other third parties who provide key functions, including payment processing, transaction processing, member support, data center facilities, and cloud computing. We rely on these third parties for a variety of services, including to transmit transaction data and settle funds to our members, and to support our ability to maintain the confidentiality, integrity, and availability of our systems and infrastructure, including websites, information, and related systems. For example, cash deposits are processed primarily by Interactive Communications International, Inc., a third-party cash deposit processor; ATM access for our members is provided by Allpoint, MoneyPass, and Visa Plus Alliance, each a third-party provider of ATM services; outbound instant transfers are processed by TabaPay, Inc., a third-party instant money movement platform; and we currently host our platform and support our operations using Amazon Web Services, a third-party provider of cloud infrastructure services. Historically, transactions have been processed by Galileo Financial Technologies, LLC (“Galileo”), a third-party payment processor. However, as of the end of 2025, we have transitioned our members’ transactions to being processed by ChimeCore. See the risk factor titled “Member transactions are now processed through ChimeCore. Any problems with the transition to ChimeCore may adversely affect our business, financial condition, and results of operations.” We also rely on our relationships with Walgreens and other retailers to provide members with the ability to make cash deposits at in-person locations. Failure by any of these third parties to perform the relevant services would adversely affect our business.

Current wording

In addition to our bank partners, we rely on third parties in connection with our products, including, but not limited to: card networks, payment gateways, and other third parties who provide key functions, including payment processing, transaction processing, member support, data center facilities, and cloud computing. We rely on these third parties for a variety of services, including to transmit transaction data and settle funds to our members, and to support our ability to maintain the confidentiality, integrity, and availability of our systems and infrastructure, including websites, information, and related systems. For example, cash deposits are processed primarily by Interactive Communications International, Inc., a third-party cash deposit processor; ATM access for our members is provided by Allpoint, MoneyPass, and Visa Plus Alliance, each a third-party provider of ATM services; outbound instant transfers are processed by TabaPay, Inc., a third-party instant money movement platform; and we currently host our platform and support our operations using Amazon Web Services, a third-party provider of cloud infrastructure services. Historically, transactions have been processed by Galileo Financial Technologies, LLC (“Galileo”), a third-party payment processor. However, as of the end of 2025, we have transitioned our members’ transactions to being processed by ChimeCore. See the risk factor titled “Member transactions are now processed through ChimeCore, our proprietary payment processor and ledger. Any problems with ChimeCore may adversely affect our business, financial condition, and results of operations.” We also rely on our relationships with Walgreens and other retailers to provide members with the ability to make cash deposits at in-person locations. Failure by any of these third parties to perform the relevant services would adversely affect our business.

Previous wording

For 2025, 2024 and 2023, we incurred net losses of $1,009.9 million, $25.3 million and $203.2 million. Although we incurred net income of $27.9 million and $81.3 million during the three and six months ended June 30, 2026, we intend to continue making investments in our business, including with respect to our employee base, sales and marketing, technology infrastructure, development of new products and features, acquisitions and other strategic transactions, infrastructure, expansion of operations, and general administration, including legal, regulatory, compliance, security, and accounting expenses related to our business. These investments may not result in increased revenue or growth in our business and may contribute to future losses. We have incurred, and may incur in the future, losses for a number of reasons, including further investments in our business, vesting and settlement of equity awards, unexpected expenditures or costs, and the other risks described in this “Risk Factors” section. If we are unable to successfully address these risks as we encounter them, our business, financial condition, and results of operations may be adversely affected.

Current wording

For 2025, 2024 and 2023, we incurred net losses of $1,009.9 million, $25.3 million and $203.2 million. Although we incurred net income of $43.7 million and $125.0 million during the three and nine months ended September 30, 2026, we intend to continue making investments in our business, including with respect to our employee base, sales and marketing, technology infrastructure, development of new products and features, acquisitions and other strategic transactions, infrastructure, expansion of operations, and general administration, including legal, regulatory, compliance, security, and accounting expenses related to our business. These investments may not result in increased revenue or growth in our business and may contribute to future losses. We have incurred, and may incur in the future, losses for a number of reasons, including further investments in our business, vesting and settlement of equity awards, unexpected expenditures or costs, and the other risks described in this “Risk Factors” section. If we are unable to successfully address these risks as we encounter them, our business, financial condition, and results of operations may be adversely affected.

Previous wording

Following the completion of our IPO, stock-based compensation expense related to existing RSUs and other outstanding equity awards, and those to be awarded in the future has resulted in and will continue to result in increases in our expenses in future periods. As of June 30, 2026, we had $550.8 million of unrecognized stock-based compensation expense related to RSUs and other outstanding equity awards expected to vest.

Current wording

Following the completion of our IPO, stock-based compensation expense related to existing RSUs and other outstanding equity awards, and those to be awarded in the future has resulted in and will continue to result in increases in our expenses in future periods. As of September 30, 2026, we had $747.5 million of unrecognized stock-based compensation expense related to RSUs and other outstanding equity awards expected to vest.

Previous wording

Our annual and quarterly revenue, results of operations, and other key metrics have fluctuated significantly in the past and may vary significantly in the future due to a variety of factors, many of which are outside of our control.

Current wording

Our annual and quarterly revenue, results of operations, and other key metrics have fluctuated significantly in the past and may vary significantly in the future due to a variety of factors, many of which are outside of our control. In addition to other risks described in this “Risk Factors” section, factors that may cause our results of operations to fluctuate include:

Previous wording

•our ability to efficiently complete or integrate any acquisitions or other strategic transactions that we may undertake;

Current wording

•our ability to efficiently complete or integrate any acquisitions or other strategic transactions that we may undertake, including the Stride Acquisition;

Previous wording

More generally, if our privacy, data protection, or data security measures or those of our bank partners, third-party developers, or third-party service providers or suppliers are inadequate or are breached, or otherwise compromised, and, as a result, there is improper use, disclosure or other processing of, or someone obtains unauthorized access to, or infiltrates, funds or other confidential, proprietary, personal, or sensitive data on our systems or our bank partners’, third-party developers’ or third-party service providers’ or suppliers’ systems, or if we, our bank partners, third-party developers, or third-party service providers or suppliers suffer a ransomware or other advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our brand and business may be harmed. If the confidential, proprietary, personal, or sensitive data is lost or improperly accessed, misused, disclosed, destroyed, altered, or otherwise processed or threatened to be improperly accessed, misused, disclosed, destroyed, altered, or otherwise processed, we may incur significant financial losses and costs and liability associated with remediation and the implementation of additional security measures and be subject to negative publicity, litigation, regulatory scrutiny, governmental investigations, and/or other actions. In addition, our bank partnership agreements contain contractual commitments for us to provide certain minimum security standards, and if we fail to meet these obligations, we are potentially directly liable to our bank partners for incremental costs and expenses they may incur as a result of such failures, and our bank partners could terminate their agreements with us.

Current wording

More generally, if our privacy, data protection, or data security measures or those of our bank partners, third-party developers, or third-party service providers or suppliers are inadequate or are breached, or otherwise compromised, and, as a result, there is improper use, disclosure or other processing of, or someone obtains unauthorized access to, or infiltrates, funds or other confidential, proprietary, personal, or sensitive data on our systems or our bank partners’, third-party developers’ or third-party service providers’ or suppliers’ systems, or if we, our bank partners, third-party developers, or third-party service providers or suppliers suffer a ransomware or other advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our brand and business may be harmed. Due to political uncertainty and military actions around the world, we and our service providers are vulnerable to heightened risks of security incidents and security and privacy breaches from or affiliated with nation-state actors, including attacks that could materially disrupt our systems, operations, supply chain, products, and services. If the confidential, proprietary, personal, or sensitive data is lost or improperly accessed, misused, disclosed, destroyed, altered, or otherwise processed or threatened to be improperly accessed, misused, disclosed, destroyed, altered, or otherwise processed, we may incur significant financial losses and costs and liability associated with remediation and the implementation of additional security measures and be subject to negative publicity, litigation, regulatory scrutiny, governmental investigations, and/or other actions. In addition, our bank partnership agreements contain contractual commitments for us to provide certain minimum security standards, and if we fail to meet these obligations, we are potentially directly liable to our bank partners for incremental costs and expenses they may incur as a result of such failures, and our bank partners could terminate their agreements with us.

Previous wording

Data breaches, malware, and other security or hacking incidents have become more prevalent across industries and may occur on our systems or the systems of our bank partners, our third-party developers, and our third-party service providers or suppliers. Additionally, due to the proliferation and increased use of generative and agentic AI, many existing threats have become more sophisticated, difficult to catch, and more likely to cause harm, while the declining cost of launching such attacks has enabled a broader range of bad actors. Any data breach, malware, or other security or hacking incident, including denial-of-service attacks, ransomware attacks, viruses, malware or other malicious code, social engineering, phishing attacks, credential stuffing, insider malfeasance, theft of assets, and account takeovers, any of which may involve unauthorized access, use, disclosure, destruction, alteration, or other processing of our information or systems, or cause intentional malfunction or loss or corruption of data, software, hardware, or other computer equipment, and the inadvertent transmission of computer viruses may adversely affect our business, financial condition, and results of operations.

Current wording

Data breaches, malware, and other security or hacking incidents have become more prevalent across industries and may occur on our systems or the systems of our bank partners, our third-party developers, and our third-party service providers or suppliers. We have experienced, and may continue to experience, cybersecurity incidents, including unauthorized account access, account takeovers, and fraudulent activity involving our products and systems. Future incidents, including incidents that are more extensive or severe than those we have experienced, could adversely affect our business, financial condition, and results of operations. Additionally, due to the proliferation and increased use of generative and agentic AI, and due to significant advances in the power of AI technology, many existing threats have become faster, more sophisticated, difficult to catch, and more likely to cause harm, while the declining cost of launching such attacks has enabled a broader range of bad actors. Any data breach, malware, or other security or hacking incident, including denial-of-service attacks, ransomware attacks, viruses, malware or other malicious code, social engineering, phishing attacks, credential stuffing, insider malfeasance, theft of assets, and account takeovers, any of which may involve unauthorized access, use, disclosure, destruction, alteration, or other processing of our information or systems, or cause intentional malfunction or loss or corruption of data, software, hardware, or other computer equipment, and the inadvertent transmission of computer viruses may adversely affect our business, financial condition, and results of operations.

Previous wording

The use of AI and ML technologies also presents emerging ethical and social issues and may draw public scrutiny or controversy due to their perceived or actual impact on members or society as a whole. For example, regulatory agencies and consumer advocacy groups have focused on potential discrimination resulting from the use of AI, ML, and “black-box” algorithms in loan decisioning models. Anti-discrimination statutes such as the Equal Credit Opportunity Act (“ECOA”) prohibit creditors from discriminating against loan applicants and consumers on the basis of race, color, religion, national origin, sex, marital status, or age, or because an applicant receives income from a public assistance program or has in good faith exercised any right under the Consumer Credit Protection Act. See the risk factor titled “Our business is subject to a wide range of complex and evolving laws and regulations, which are subject to change and to uncertain interpretation, and failure by us or by our bank partners or third-party service providers to comply with such laws and regulations may adversely affect our business, financial condition, and results of operations.” Any “disparate impact” on protected groups, whether due to our use of AI and ML in our risk management and other models or otherwise, would require us to revise the models in a manner that may limit product eligibility criteria or result in higher risk losses. Moreover, because these decisions are driven by complex or “black-box” algorithms, our inability to explain or interpret their basis could complicate demonstrations of compliance with anti-discrimination laws and responses to regulatory inquiries. Separately, the rapid pace of AI innovation and competition for specialized talent mean that delays in upgrading our models or retaining qualified personnel could erode our competitive position. Issues relating to our use of AI and ML technologies and the evolving legal and regulatory landscape applicable to such technologies may adversely affect our brand, business, financial condition, and results of operations.

Current wording

The use of AI and ML technologies also presents emerging ethical and social issues and may draw public scrutiny or controversy due to their perceived or actual impact on members or society as a whole. For example, regulatory agencies and consumer advocacy groups have focused on potential discrimination resulting from the use of AI, ML, and “black-box” algorithms in loan decisioning models. Anti-discrimination statutes such as the Equal Credit Opportunity Act (“ECOA”) prohibit creditors from discriminating against loan applicants and consumers on the basis of race, color, religion, national origin, sex, marital status, or age, or because an applicant receives income from a public assistance program or has in good faith exercised any right under the Consumer Credit Protection Act. See the risk factor titled “Our business is subject to a wide range of complex and evolving laws and regulations, which are subject to change and to uncertain interpretation, and failure by us or by our bank partners or third-party service providers to comply with such laws and regulations may adversely affect our business, financial condition, and results of operations.” Any “disparate impact” on protected groups, whether due to our use of AI and ML in our risk management and other models or otherwise, would require us to revise the models in a manner that may limit product eligibility criteria or result in higher risk losses. Moreover, because these decisions are driven by complex or “black-box” algorithms, our inability to explain or interpret their basis could complicate demonstrations of compliance with anti-discrimination laws, compliance with requirements related to automated decision making, including under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), and responses to regulatory inquiries. Separately, the rapid pace of AI innovation and competition for specialized talent mean that delays in upgrading our models or retaining qualified personnel could erode our competitive position. Issues relating to our use of AI and ML technologies and the evolving legal and regulatory landscape applicable to such technologies may adversely affect our brand, business, financial condition, and results of operations.

Previous wording

Our success depends in part on the continued service of Christopher Britt, our Co-Founder, Chairman, and Chief Executive Officer, and Ryan King, our Co-Founder and a member of our board of directors, as well as our senior management team and other key employees. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, potentially disrupting our business. Any employment agreements we have with our executive officers or other key personnel do not require them to continue to work for us for any specified period and, therefore, they may terminate their employment with us at any time. In addition, we do not maintain any key person life insurance policies. The loss of either of our Co-Founders or any other member of our senior management team, or key personnel may delay or prevent the achievement of our business objectives, and because of the nature of our business, the loss of any significant number of our existing engineering and project management personnel may also adversely affect our business, financial condition, and results of operations.

Current wording

Our success depends in part on the continued service of Christopher Britt, our Co-Founder, Chairman, and Chief Executive Officer, and Ryan King, our Co-Founder and a member of our board of directors, as well as our senior management team and other key employees. From time to time, we have experienced transitions in executive leadership roles, and future changes could disrupt our business. Any employment agreements we have with our executive officers or other key personnel do not require them to continue to work for us for any specified period and, therefore, they may terminate their employment with us at any time. In addition, we do not maintain any key person life insurance policies. The loss of either of our Co-Founders or any other member of our senior management team, or key personnel may delay or prevent the achievement of our business objectives, and because of the nature of our business, the loss of any significant number of our existing engineering and project management personnel may also adversely affect our business, financial condition, and results of operations.

Previous wording

As part of our business strategy, we will continue to consider a wide array of potential strategic transactions, including acquisitions of businesses, new technologies, services, and other assets and strategic investments that complement our business. We have previously acquired and continue to evaluate targets that operate in relatively nascent markets, such as our acquisition of Salt Labs in June 2024, and there is no assurance that such acquired businesses will be successfully integrated into our business or generate substantial revenue. We may be unable to identify or complete prospective strategic transactions for many reasons, including competition from other potential acquirers, the effects of consolidation in our industries, and potentially high valuations of acquisition candidates. Even if we do identify strategic transactions or enter into agreements with respect to such transactions, applicable antitrust laws and other regulations may limit our ability to acquire targets or force us to divest all or a portion of our business or an acquired business. If we are unable to identify suitable targets or complete acquisitions, our growth prospects may suffer, and we may not be able to realize sufficient scale and technological advantages to compete effectively in all markets.

Current wording

As part of our business strategy, we will continue to consider a wide array of potential strategic transactions, including acquisitions of businesses, new technologies, services, and other assets and strategic investments that complement our business. We have previously acquired and continue to evaluate targets that operate in relatively nascent markets, such as our acquisition of Salt Labs in June 2024, and there is no assurance that such acquired businesses will be successfully integrated into our business or generate substantial revenue. In September 2026, we entered into the Merger Agreement to acquire CSC, the parent holding company of Stride. For a discussion of risks related to the Stride Acquisition, see the section titled “Risks Related to the Pending Stride Acquisition.” We may be unable to identify or complete prospective strategic transactions for many reasons, including competition from other potential acquirers, the effects of consolidation in our industries, and potentially high valuations of acquisition candidates. Even if we do identify strategic transactions or enter into agreements with respect to such transactions, applicable antitrust laws and other regulations may limit our ability to acquire targets or force us to divest all or a portion of our business or an acquired business. If we are unable to identify suitable targets or complete acquisitions, our growth prospects may suffer, and we may not be able to realize sufficient scale and technological advantages to compete effectively in all markets.

Previous wording

These laws and regulations, all of which are subject to change and many of which are subject to uncertain interpretation and application, are enforced by multiple authorities and governing bodies in the United States, including federal agencies, such as the Consumer Financial Protection Bureau (“CFPB”), Office of the Comptroller of the Currency (“OCC”), the Federal Reserve Board and FDIC, self-regulatory organizations, and numerous state and local agencies. In addition, new laws or regulations may be adopted that further regulate our business and/or our bank partners. We may not always be able to accurately predict the scope or applicability of regulations to our business, particularly as we launch new products or expand into new areas of operations.

Current wording

These laws and regulations, all of which are subject to change and many of which are subject to uncertain interpretation and application, are enforced by multiple authorities and governing bodies in the United States, including federal agencies, such as the Consumer Financial Protection Bureau (“CFPB”), OCC, the Federal Reserve Board and FDIC, self-regulatory organizations, and numerous state and local agencies. In addition, new laws or regulations may be adopted that further regulate our business and/or our bank partners. We may not always be able to accurately predict the scope or applicability of regulations to our business, particularly as we launch new products or expand into new areas of operations.

Previous wording

The CFPB is also authorized to prevent “unfair, deceptive, or abusive acts or practices” through its rulemaking, supervisory, and enforcement authority. To assist in its enforcement, the CFPB maintains an online complaint system that allows consumers to log complaints with respect to various consumer finance products, including the types of products we offer to members on our platform. The CFPB may request reports concerning our organization, business conduct, markets, and activities.

Current wording

The CFPB is also authorized to prevent “unfair, deceptive, or abusive acts or practices” through its rulemaking, supervisory, and enforcement authority. To assist in its enforcement, the CFPB maintains an online complaint system that allows consumers to log complaints with respect to various consumer finance products, including the types of products we offer to members on our platform. The CFPB may require reports concerning our organization, business conduct, markets, and activities.

Previous wording

We are subject to numerous laws, regulations, guidance, and industry standards relating to the collection, storage, use, disclosure, transfer, and other processing of a wide variety of information, including non-public personal information and other personal information of our members. We are also subject to stringent contractual and other requirements relating to privacy, data protection, and data security, including requirements from our bank partners to safeguard non-public personal information. The legal and regulatory environment, and our contractual and other requirements, relating to privacy, data protection, and data security is rapidly evolving and may develop and evolve in ways we cannot predict. Further, these requirements may apply generally to the handling of personal information or may be specific to industries, sectors, contexts, or locations. The continued proliferation of laws and regulations relating to privacy, data protection, and data security in the jurisdictions in which we operate is likely to result in a disparate array of laws, regulations, guidance, industry standards, and other actual and asserted obligations with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and may lead to unintended consumer confusion. In addition, we may become subject to additional laws and regulations relating to privacy, data protection, and data security in jurisdictions in which we may operate in the future (including any non-U.S. jurisdictions), which may require us to change our business practices and result in increased compliance costs.

Current wording

We are subject to numerous laws, regulations, guidance, and industry standards relating to the collection, storage, use, disclosure, transfer, and other processing of a wide variety of information, including non-public personal information and other personal information of our members. We are also subject to stringent contractual and other requirements relating to privacy, data protection, and data security, including requirements from our bank partners to safeguard non-public personal information. The legal and regulatory environment, and our contractual and other requirements, relating to privacy, data protection, and data security is rapidly evolving and may develop and evolve in ways we cannot predict. Further, these requirements may apply generally to the handling of personal information or may be specific to industries, sectors, contexts, or locations. The continued proliferation of laws and regulations relating to privacy, data protection, and data security in the jurisdictions in which we operate is likely to result in a disparate array of laws, regulations, guidance, industry standards, and other actual and asserted obligations with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and may lead to unintended consumer confusion. In addition, we may become subject to additional laws and regulations relating to privacy, data protection, and data security in jurisdictions in which we may operate in the future (including any non-U.S. jurisdictions), or as the result of new business activities or acquisitions, such as the Stride Acquisition, which may require us to change our business practices and result in increased compliance costs.

Previous wording

Many jurisdictions in which we operate have enacted, or are in the process of enacting, laws or regulations addressing privacy, data protection, and data security. For example, in the United States there are numerous federal and state privacy, data protection, and data security laws and regulations governing the collection, storage, use, disclosure, transfer, and other processing of personal information. Certain of our information processing activities are subject to requirements of the Gramm Leach Bliley Act (which regulates the confidentiality and security of non-public personal information obtained by financial institutions, including non-banking financial institutions significantly engaged in providing financial products or services) (the “GLBA”). In addition, we are subject to the laws and regulations promulgated under the authority of the Federal Trade Commission (which regulates unfair or deceptive acts or practices, including with respect to privacy, data protection and data security). At the state level, California and numerous other U.S. states have enacted, are in the process of enacting or are proposing to enact comprehensive state-level privacy laws governing the collection, storage, use, disclosure, deletion, transfer, and other processing of their residents’ personal information. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), gives California residents rights in their personal information including to access and delete their personal information, opt out of sales of personal information or other personal information sharing, and receive detailed information about how their personal information is used. The CCPA also prohibits covered companies from discriminating against California residents for exercising any of their CCPA rights and provides for severe civil penalties for violations as well as a private right of action for data breaches.

Current wording

Many jurisdictions in which we operate have enacted, or are in the process of enacting, laws or regulations addressing privacy, data protection, and data security. For example, in the United States there are numerous federal and state privacy, data protection, and data security laws and regulations governing the collection, storage, use, disclosure, transfer, and other processing of personal information. Certain of our information processing activities are subject to requirements of the Gramm Leach Bliley Act (which regulates the confidentiality and security of non-public personal information obtained by financial institutions, including non-banking financial institutions significantly engaged in providing financial products or services) (the “GLBA”). In addition, we are subject to the laws and regulations promulgated under the authority of the Federal Trade Commission (which regulates unfair or deceptive acts or practices, including with respect to privacy, data protection and data security). At the state level, California and numerous other U.S. states have enacted, are in the process of enacting or are proposing to enact comprehensive state-level privacy laws governing the collection, storage, use, disclosure, deletion, transfer, and other processing of their residents’ personal information. For example, the CCPA, gives California residents rights in their personal information including to access and delete their personal information, opt out of sales of personal information or other personal information sharing, and receive detailed information about how their personal information is used. The CCPA also prohibits covered companies from discriminating against California residents for exercising any of their CCPA rights and provides for severe civil penalties for violations as well as a private right of action for data breaches. Beginning January 1, 2027, regulations under the CCPA also impose requirements on businesses that use automated decisionmaking technology to make significant decisions about consumers, including decisions regarding financial or lending services, such as pre-use notices and, subject to certain exceptions, consumer rights to opt out of and access information about such use. Although the CCPA exempts certain information subject to the GLBA, that exemption may not cover all personal information we process, and to the extent these requirements apply to our activities, compliance with these requirements, including following the completion of the Stride Acquisition, may increase our costs, require us to modify our products or models, or subject us to enforcement actions.

Previous wording

Moreover, while we strive to publish and prominently display privacy notices that are accurate, comprehensive, and compliant with applicable laws, regulations, guidance, and industry standards, we cannot ensure that such privacy notices and other statements (including the privacy notices and statements that we display on behalf of our bank partners) or those of our third-party service providers will be sufficient to protect us from claims, proceedings, liability, or adverse publicity relating to privacy, data protection, and data security. Although we endeavor to comply with such privacy notices, we, our bank partners, or our third-party service providers may at times fail to do so or be alleged to have failed to do so. If such public statements about the use, collection, disclosure collection, storage, use, disclosure, transfer, and other processing of personal information (including non-public personal information), whether made through the privacy notices or statements provided on our, or our third-party service providers’, websites press releases, or otherwise, are alleged to be deceptive, unfair, or misrepresentative of our, our bank partners’, or our third-party service providers’ actual practices, we may be subject to potential government or legal investigation or action, including by the Federal Trade Commission or applicable state attorneys general.

Current wording

Moreover, while we strive to publish and prominently display privacy notices that are accurate, comprehensive, and compliant with applicable laws, regulations, guidance, and industry standards, we cannot ensure that such privacy notices and other statements (including the privacy notices and statements that we display on behalf of our bank partners) or those of our third-party service providers will be sufficient to protect us from claims, proceedings, liability, or adverse publicity relating to privacy, data protection, and data security. Although we endeavor to comply with such privacy notices, we, our bank partners, or our third-party service providers may at times fail to do so or be alleged to have failed to do so. If such public statements about the use, collection, disclosure, storage, transfer, and other processing of personal information (including non-public personal information), whether made through the privacy notices or statements provided on our, or our third-party service providers’, websites press releases, or otherwise, are alleged to be deceptive, unfair, or misrepresentative of our, our bank partners’, or our third-party service providers’ actual practices, we may be subject to potential government or legal investigation or action, including by the Federal Trade Commission, applicable state attorneys general, or other regulatory authorities.

Previous wording

As of December 31, 2025, we recorded a full valuation allowance on our U.S. deferred tax assets. A valuation allowance may be established to reduce a deferred tax asset to the level at which it is more likely than not that the tax asset or benefits will be realized. The establishment of a valuation allowance requires an assessment of both positive and negative evidence when determining whether deferred tax assets are more likely than not to be realized. We continue to monitor the likelihood that we will be able to realize our deferred tax assets in the future and we may in the future make adjustments to our valuation allowance. Any future recording or release to our valuation allowance may have an adverse effect on our results of operations.

Current wording

As of December 31, 2025, we recorded a full valuation allowance on our U.S. deferred tax assets. A valuation allowance may be established to reduce a deferred tax asset to the level at which it is more likely than not that the tax asset or benefits will be realized. The establishment of a valuation allowance requires an assessment of both positive and negative evidence when determining whether deferred tax assets are more likely than not to be realized. We continue to monitor the likelihood that we will be able to realize our deferred tax assets in the future and we may in the future make adjustments to our valuation allowance. If we continue to generate pretax income, sufficient positive evidence may become available in a future period for us to conclude that all or a significant portion of the valuation allowance is no longer required. The timing and amount of any release remain uncertain and will depend on several factors, including the level and sustainability of our profitability. Any future recording or release to our valuation allowance may have an adverse effect on our results of operations.

Previous wording

A significant natural disaster, such as an earthquake, fire, hurricane, tornado, flood, or significant power outage, may disrupt our operations, mobile networks, the internet, or the operations of our bank partners or third-party service providers, and the impact of climate change may increase these risks. In particular, our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity and increasingly for the threat of fires. In addition, any public health crises, such as the COVID-19 pandemic or other epidemics, political crises, terrorist attacks, war and other political or social instability, and other geopolitical developments, or other catastrophic events, whether in the United States or abroad, may adversely affect our operations or macroeconomic conditions. The impact of any natural disaster, act of terrorism, or other disruption to us, our bank partners, or other third parties may result system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, data breaches, malware, and other security or hacking incidents, all of which may adversely affect our business, financial condition, and results of operations. All of the aforementioned risks may be further increased if our disaster recovery plans prove to be inadequate. Further, the insurance we maintain may be insufficient to cover our losses resulting from such business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

Current wording

A significant natural disaster, such as an earthquake, fire, hurricane, tornado, flood, or significant power outage, may disrupt our operations, mobile networks, the internet, or the operations of our bank partners or third-party service providers, and the impact of climate change may increase these risks. In particular, our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity and increasingly for the threat of fires. In addition, any public health crises, such as the COVID-19 pandemic or other epidemics, political crises, terrorist attacks, war and other political or social instability, and other geopolitical developments, or other catastrophic events, whether in the United States or abroad, may adversely affect our operations or macroeconomic conditions. The impact of any natural disaster, act of terrorism, including cyberattacks by nation-state actors and affiliated groups against U.S. companies, including companies in the financial services sector, or other disruption to us, our bank partners, or other third parties may result in system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, data breaches, malware, and other security or hacking incidents, all of which may adversely affect our business, financial condition, and results of operations. All of the aforementioned risks may be further increased if our disaster recovery plans prove to be inadequate. Further, the insurance we maintain may be insufficient to cover our losses resulting from such business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

Previous wording

Our Class A common stock has one vote per share, our Class B common stock has 20 votes per share, and our Class C common stock has no voting rights, except as otherwise required by law. Our Co-Founders beneficially own all of the outstanding shares of our Class B common stock. As of June 30, 2026, Christopher Britt, our Co-Founder, Chairman, and Chief Executive Officer, held approximately 34.5% of the voting power of our outstanding capital stock; and Ryan King, our Co-Founder and a member of our board of directors, held approximately 30.1% of the voting power of our outstanding capital stock, which voting power may increase over time as our Co-Founders exercise or vest and settle in equity awards (including in connection with the rights we granted each of our Co-Founders, pursuant to equity exchange right agreements we entered into with them, to require us to exchange any shares of Class A common stock received upon the exercise of options to purchase shares of Class A common stock or upon vesting and settlement of restricted stock units, in each case for an equivalent number of shares of Class B common stock (the “Equity Award Exchange”) outstanding at the time of the completion of the IPO. If all such equity awards held by our Co-Founders (including the RSUs granted to our Co-Founders pursuant to the 2025 Co-Founder Special Awards that vest upon the satisfaction of a service condition and achievement of certain stock price goals (the “2025 Co-Founder Special Awards”)) had been exercised or had vested and been settled, as applicable, and the resulting shares of Class A common stock had been exchanged for shares of Class B common stock pursuant to the Equity Award Exchange, in each case as of June 30, 2026, Messrs. Britt and King would hold approximately 40.0% and 33.5% of the voting power of our outstanding capital stock. These future issuances of our Class B common stock will further dilute the voting power of our Class A common stock.

Current wording

Our Class A common stock has one vote per share, our Class B common stock has 20 votes per share, and our Class C common stock has no voting rights, except as otherwise required by law. Our Co-Founders beneficially own all of the outstanding shares of our Class B common stock. As of September 30, 2026, Christopher Britt, our Co-Founder, Chairman, and Chief Executive Officer, held approximately 33.5% of the voting power of our outstanding capital stock; and Ryan King, our Co-Founder and a member of our board of directors, held approximately 29.8% of the voting power of our outstanding capital stock, which voting power may increase over time as our Co-Founders exercise or vest and settle in equity awards (including in connection with the rights we granted each of our Co-Founders, pursuant to equity exchange right agreements we entered into with them, to require us to exchange any shares of Class A common stock received upon the exercise of options to purchase shares of Class A common stock or upon vesting and settlement of restricted stock units, in each case for an equivalent number of shares of Class B common stock (the “Equity Award Exchange”) outstanding at the time of the completion of the IPO. If all such equity awards held by our Co-Founders (including the RSUs granted to our Co-Founders pursuant to the 2025 Co-Founder Special Awards that vest upon the satisfaction of a service condition and achievement of certain stock price goals (the “2025 Co-Founder Special Awards”)) had been exercised or had vested and been settled, as applicable, and the resulting shares of Class A common stock had been exchanged for shares of Class B common stock pursuant to the Equity Award Exchange, in each case as of September 30, 2026, Messrs. Britt and King would hold approximately 39.2% and 33.3% of the voting power of our outstanding capital stock. These future issuances of our Class B common stock will further dilute the voting power of our Class A common stock.

Previous wording

Our amended and restated certificate of incorporation authorizes us to issue up to an aggregate of 5,565,000,000 shares of common stock and up to 100,000,000 shares of preferred stock with such rights, powers, and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of Class A common stock or securities convertible into shares of our Class A common stock from time to time in connection with a financing, acquisition, investment, our equity incentive plans, or otherwise. Any such issuances may result in substantial dilution to our existing stockholders and cause the market price of our Class A common stock to decline.

Current wording

Our amended and restated certificate of incorporation authorizes us to issue up to an aggregate of 5,565,000,000 shares of common stock and up to 100,000,000 shares of preferred stock with such rights, powers, and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of Class A common stock or securities convertible into shares of our Class A common stock from time to time in connection with a financing, acquisition, investment, our equity incentive plans, or otherwise. Any such issuances may result in substantial dilution to our existing stockholders and cause the market price of our Class A common stock to decline. Furthermore, certain stockholders are entitled, under our amended and restated investors’ rights agreement, to demand registration rights.

Previous wording

We do not anticipate paying cash dividends in the foreseeable future. We currently intend to retain future earnings, if any, to fund the development and growth of our business. In addition, our credit facility contains, and any future credit facility or financing we obtain may contain, terms limiting the amount of cash dividends that may be declared or paid on our capital stock. Any future determination to pay cash dividends will be at the discretion of our board of directors and will be dependent upon our financial condition, results of operations, capital requirements, and applicable contractual restrictions. As a result, stockholders should rely on sales of their Class A common stock after price appreciation, if any, as the only way to realize any future gains on their investment.

Current wording

We do not anticipate paying cash dividends in the foreseeable future. We currently intend to retain future earnings, if any, to fund the development and growth of our business. In addition, our credit facility contains, and any future credit facility or financing we obtain may contain, terms limiting the amount of cash dividends that may be declared or paid on our capital stock. In addition, following the completion of the Stride Acquisition, our ability to pay dividends will be subject to the policies of the Federal Reserve Board applicable to bank holding companies, and Stride’s ability to pay dividends to us will be subject to restrictions under federal banking laws. Any future determination to pay cash dividends will be at the discretion of our board of directors and will be dependent upon our financial condition, results of operations, capital requirements, and applicable contractual restrictions. As a result, stockholders should rely on sales of their Class A common stock after price appreciation, if any, as the only way to realize any future gains on their investment.